diff --git a/.devcontainer/setup.sh b/.devcontainer/setup.sh
index 2c510a3a5e2..af1dfebf30d 100755
--- a/.devcontainer/setup.sh
+++ b/.devcontainer/setup.sh
@@ -1,4 +1,6 @@
 #!/bin/bash
+set +o histexpand
+
 
 # install project dependencies
 make deps
diff --git a/actions/setup-cli/install.sh b/actions/setup-cli/install.sh
index 9e529ff4332..63bd5a405a5 100755
--- a/actions/setup-cli/install.sh
+++ b/actions/setup-cli/install.sh
@@ -1,4 +1,6 @@
 #!/bin/bash
+set +o histexpand
+
 
 # Script to download and install gh-aw binary for the current OS and architecture
 # Supports: Linux, macOS (Darwin), FreeBSD, Windows (Git Bash/MSYS/Cygwin)
diff --git a/actions/setup-cli/install_test.sh b/actions/setup-cli/install_test.sh
index 8a22eb09052..d758fc66b4d 100755
--- a/actions/setup-cli/install_test.sh
+++ b/actions/setup-cli/install_test.sh
@@ -1,4 +1,6 @@
 #!/bin/bash
+set +o histexpand
+
 # Test script for install.sh in setup-cli action
 set -e
 
diff --git a/actions/setup/clean.sh b/actions/setup/clean.sh
index 58857577bc8..1eca8c3fb66 100755
--- a/actions/setup/clean.sh
+++ b/actions/setup/clean.sh
@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+set +o histexpand
+
 # Clean Action Post Script
 # Mirror of actions/setup/post.js for script mode (run: bash steps).
 # Sends an OTLP conclusion span then removes the /tmp/gh-aw/ directory.
diff --git a/actions/setup/js/mount_mcp_as_cli.cjs b/actions/setup/js/mount_mcp_as_cli.cjs
index ce57f856b63..81702623441 100644
--- a/actions/setup/js/mount_mcp_as_cli.cjs
+++ b/actions/setup/js/mount_mcp_as_cli.cjs
@@ -289,6 +289,8 @@ function generateCLIWrapperScript(serverName, serverUrl, toolsFile, apiKey, brid
   const safeBridge = shellEscapeDoubleQuoted(bridgeScript);
 
   return `#!/usr/bin/env bash
+set +o histexpand
+
 # MCP CLI wrapper for: ${safeName}
 # Auto-generated by gh-aw. Do not modify.
 #
diff --git a/actions/setup/setup.sh b/actions/setup/setup.sh
index 30082b5a01f..ae7899627b8 100755
--- a/actions/setup/setup.sh
+++ b/actions/setup/setup.sh
@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+set +o histexpand
+
 # Setup Action
 # Copies activation job files to the agent environment
 #
diff --git a/actions/setup/sh/append_agent_step_summary.sh b/actions/setup/sh/append_agent_step_summary.sh
index 6ee0572038b..e572735911a 100644
--- a/actions/setup/sh/append_agent_step_summary.sh
+++ b/actions/setup/sh/append_agent_step_summary.sh
@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+set +o histexpand
+
 # Append the agent's step summary to the real $GITHUB_STEP_SUMMARY.
 # The file was written by the agent and already redacted for secrets.
 # This is a no-op when the file is empty (agent wrote nothing).
diff --git a/actions/setup/sh/check_mcp_servers.sh b/actions/setup/sh/check_mcp_servers.sh
index 0f1bffe53fe..dca59b00a6c 100755
--- a/actions/setup/sh/check_mcp_servers.sh
+++ b/actions/setup/sh/check_mcp_servers.sh
@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+set +o histexpand
+
 # Check MCP Server Functionality
 # This script performs basic functionality checks on MCP servers configured by the MCP gateway
 # It sends an MCP ping + initialize + tools/list request to each server to verify backend connectivity
diff --git a/actions/setup/sh/check_mcp_servers_test.sh b/actions/setup/sh/check_mcp_servers_test.sh
index 63ec915a5dd..d156117b763 100755
--- a/actions/setup/sh/check_mcp_servers_test.sh
+++ b/actions/setup/sh/check_mcp_servers_test.sh
@@ -1,4 +1,6 @@
 #!/bin/bash
+set +o histexpand
+
 # Test script for check_mcp_servers.sh
 set -e
 
diff --git a/actions/setup/sh/clean_git_credentials.sh b/actions/setup/sh/clean_git_credentials.sh
index 2c0df08869c..487f3cb1fc9 100755
--- a/actions/setup/sh/clean_git_credentials.sh
+++ b/actions/setup/sh/clean_git_credentials.sh
@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+set +o histexpand
+
 #
 # clean_git_credentials.sh - Remove git credentials from all git checkouts
 #
diff --git a/actions/setup/sh/clean_git_credentials_test.sh b/actions/setup/sh/clean_git_credentials_test.sh
index a19ace2f547..cd0a487b19b 100644
--- a/actions/setup/sh/clean_git_credentials_test.sh
+++ b/actions/setup/sh/clean_git_credentials_test.sh
@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+set +o histexpand
+
 # Test script for clean_git_credentials.sh
 # Run: bash clean_git_credentials_test.sh
 
diff --git a/actions/setup/sh/clone_repo_memory_branch.sh b/actions/setup/sh/clone_repo_memory_branch.sh
index 9c628d596f8..d0b8d1f92fb 100644
--- a/actions/setup/sh/clone_repo_memory_branch.sh
+++ b/actions/setup/sh/clone_repo_memory_branch.sh
@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+set +o histexpand
+
 # Clone repo-memory branch script
 # Clones a repo-memory branch or creates an orphan branch if it doesn't exist
 #
diff --git a/actions/setup/sh/commit_cache_memory_git.sh b/actions/setup/sh/commit_cache_memory_git.sh
index 9764ddb0b18..ad0a11b9bdd 100644
--- a/actions/setup/sh/commit_cache_memory_git.sh
+++ b/actions/setup/sh/commit_cache_memory_git.sh
@@ -1,4 +1,6 @@
 #!/bin/bash
+set +o histexpand
+
 # commit_cache_memory_git.sh
 # Post-agent git commit for integrity-aware cache-memory.
 #
diff --git a/actions/setup/sh/compute_artifact_prefix.sh b/actions/setup/sh/compute_artifact_prefix.sh
index 5601f1963b7..c1aa0d5d7d9 100644
--- a/actions/setup/sh/compute_artifact_prefix.sh
+++ b/actions/setup/sh/compute_artifact_prefix.sh
@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+set +o histexpand
+
 #
 # compute_artifact_prefix.sh - Compute a stable artifact name prefix for workflow_call runs
 #
diff --git a/actions/setup/sh/configure_gh_for_ghe.sh b/actions/setup/sh/configure_gh_for_ghe.sh
index 056fd92f601..f7593c53850 100755
--- a/actions/setup/sh/configure_gh_for_ghe.sh
+++ b/actions/setup/sh/configure_gh_for_ghe.sh
@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+set +o histexpand
+
 # Configure gh CLI for GitHub Enterprise
 #
 # This script configures the gh CLI to work with GitHub Enterprise environments
diff --git a/actions/setup/sh/configure_gh_for_ghe_test.sh b/actions/setup/sh/configure_gh_for_ghe_test.sh
index d834bcd979c..80e5e766ba7 100755
--- a/actions/setup/sh/configure_gh_for_ghe_test.sh
+++ b/actions/setup/sh/configure_gh_for_ghe_test.sh
@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+set +o histexpand
+
 # Test script for configure_gh_for_ghe.sh
 
 set -e
diff --git a/actions/setup/sh/convert_gateway_config_claude.sh b/actions/setup/sh/convert_gateway_config_claude.sh
index 926d47065ee..1fdaa2aafbb 100755
--- a/actions/setup/sh/convert_gateway_config_claude.sh
+++ b/actions/setup/sh/convert_gateway_config_claude.sh
@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+set +o histexpand
+
 # Convert MCP Gateway Configuration to Claude Format
 # This script converts the gateway's standard HTTP-based MCP configuration
 # to the JSON format expected by Claude (without Copilot-specific fields)
diff --git a/actions/setup/sh/convert_gateway_config_codex.sh b/actions/setup/sh/convert_gateway_config_codex.sh
index f172c0b206f..c9fc7e1330d 100755
--- a/actions/setup/sh/convert_gateway_config_codex.sh
+++ b/actions/setup/sh/convert_gateway_config_codex.sh
@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+set +o histexpand
+
 # Convert MCP Gateway Configuration to Codex Format
 # This script converts the gateway's standard HTTP-based MCP configuration
 # to the TOML format expected by Codex
diff --git a/actions/setup/sh/convert_gateway_config_codex_test.sh b/actions/setup/sh/convert_gateway_config_codex_test.sh
index 4a4f71c4f26..e982351e842 100755
--- a/actions/setup/sh/convert_gateway_config_codex_test.sh
+++ b/actions/setup/sh/convert_gateway_config_codex_test.sh
@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+set +o histexpand
+
 # Test script for convert_gateway_config_codex.sh
 
 set -e
diff --git a/actions/setup/sh/convert_gateway_config_copilot.sh b/actions/setup/sh/convert_gateway_config_copilot.sh
index 5544165dae9..add43b6659b 100755
--- a/actions/setup/sh/convert_gateway_config_copilot.sh
+++ b/actions/setup/sh/convert_gateway_config_copilot.sh
@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+set +o histexpand
+
 # Convert MCP Gateway Configuration to Copilot Format
 # This script converts the gateway's standard HTTP-based MCP configuration
 # to the format expected by GitHub Copilot CLI
diff --git a/actions/setup/sh/convert_gateway_config_crush.sh b/actions/setup/sh/convert_gateway_config_crush.sh
index 74cbc068149..f1258a44668 100644
--- a/actions/setup/sh/convert_gateway_config_crush.sh
+++ b/actions/setup/sh/convert_gateway_config_crush.sh
@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+set +o histexpand
+
 # Convert MCP Gateway Configuration to Crush Format
 # This script converts the gateway's standard HTTP-based MCP configuration
 # to the JSON format expected by Crush (.crush.json)
diff --git a/actions/setup/sh/convert_gateway_config_gemini.sh b/actions/setup/sh/convert_gateway_config_gemini.sh
index 046ec3d47a3..45598f481aa 100644
--- a/actions/setup/sh/convert_gateway_config_gemini.sh
+++ b/actions/setup/sh/convert_gateway_config_gemini.sh
@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+set +o histexpand
+
 # Convert MCP Gateway Configuration to Gemini Format
 # This script converts the gateway's standard HTTP-based MCP configuration
 # to the JSON format expected by Gemini CLI (.gemini/settings.json)
diff --git a/actions/setup/sh/copy_copilot_session_state.sh b/actions/setup/sh/copy_copilot_session_state.sh
index eff95a2fb01..887cf07033d 100755
--- a/actions/setup/sh/copy_copilot_session_state.sh
+++ b/actions/setup/sh/copy_copilot_session_state.sh
@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+set +o histexpand
+
 # Copy the entire Copilot session-state directory to the agent logs folder
 # for artifact collection. This ensures all session files (events.jsonl,
 # session.db, plan.md, checkpoints, etc.) are in /tmp/gh-aw/ where secret
diff --git a/actions/setup/sh/download_docker_images.sh b/actions/setup/sh/download_docker_images.sh
index 79b026b7086..48213a0c522 100755
--- a/actions/setup/sh/download_docker_images.sh
+++ b/actions/setup/sh/download_docker_images.sh
@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+set +o histexpand
+
 # Download Docker images with retry logic and controlled parallelism
 # Usage: download_docker_images.sh IMAGE1 [IMAGE2 ...]
 #
diff --git a/actions/setup/sh/download_docker_images_test.sh b/actions/setup/sh/download_docker_images_test.sh
index 3c8c22dc3f8..1416e370b25 100755
--- a/actions/setup/sh/download_docker_images_test.sh
+++ b/actions/setup/sh/download_docker_images_test.sh
@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+set +o histexpand
+
 # Test script for download_docker_images.sh
 # Tests concurrent download functionality
 
diff --git a/actions/setup/sh/install_awf_binary.sh b/actions/setup/sh/install_awf_binary.sh
index e95bff73f8b..4373012165b 100755
--- a/actions/setup/sh/install_awf_binary.sh
+++ b/actions/setup/sh/install_awf_binary.sh
@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+set +o histexpand
+
 # Install AWF (Agentic Workflow Firewall) with SHA256 checksum verification
 # Usage: install_awf_binary.sh VERSION
 #
diff --git a/actions/setup/sh/install_copilot_cli.sh b/actions/setup/sh/install_copilot_cli.sh
index ec2de64af3a..e7fec32d8e0 100755
--- a/actions/setup/sh/install_copilot_cli.sh
+++ b/actions/setup/sh/install_copilot_cli.sh
@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+set +o histexpand
+
 # Install GitHub Copilot CLI with SHA256 checksum verification
 # Usage: install_copilot_cli.sh [VERSION]
 #
diff --git a/actions/setup/sh/install_docker_macos.sh b/actions/setup/sh/install_docker_macos.sh
index e093997a94d..d5eec9a0482 100755
--- a/actions/setup/sh/install_docker_macos.sh
+++ b/actions/setup/sh/install_docker_macos.sh
@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+set +o histexpand
+
 # Install Docker on macOS GitHub Actions runners via colima
 # Usage: install_docker_macos.sh
 #
diff --git a/actions/setup/sh/install_gh_cli.sh b/actions/setup/sh/install_gh_cli.sh
index 6a063229194..65729234d7e 100644
--- a/actions/setup/sh/install_gh_cli.sh
+++ b/actions/setup/sh/install_gh_cli.sh
@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+set +o histexpand
+
 # Install GitHub CLI (gh) if not already present
 #
 # This script installs the GitHub CLI using the official apt repository on
diff --git a/actions/setup/sh/parse_guard_list.sh b/actions/setup/sh/parse_guard_list.sh
index 9154be7b296..b33d11dd469 100755
--- a/actions/setup/sh/parse_guard_list.sh
+++ b/actions/setup/sh/parse_guard_list.sh
@@ -1,4 +1,6 @@
 #!/bin/bash
+set +o histexpand
+
 set -eo pipefail
 
 # parse_guard_list.sh - Parse comma/newline-separated guard policy lists into JSON arrays
diff --git a/actions/setup/sh/restore_base_github_folders.sh b/actions/setup/sh/restore_base_github_folders.sh
index 3fc5c623c48..3c86ce0393c 100644
--- a/actions/setup/sh/restore_base_github_folders.sh
+++ b/actions/setup/sh/restore_base_github_folders.sh
@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+set +o histexpand
+
 #
 # restore_base_github_folders.sh - Restore agent config folders/files from the base
 #                                   branch snapshot after PR checkout
diff --git a/actions/setup/sh/restore_base_github_folders_test.sh b/actions/setup/sh/restore_base_github_folders_test.sh
index 281e827c014..4212623e33d 100644
--- a/actions/setup/sh/restore_base_github_folders_test.sh
+++ b/actions/setup/sh/restore_base_github_folders_test.sh
@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+set +o histexpand
+
 # Tests for restore_base_github_folders.sh
 # Run: bash restore_base_github_folders_test.sh
 
diff --git a/actions/setup/sh/sanitize_path.sh b/actions/setup/sh/sanitize_path.sh
index 3d16cd4d984..d0293166938 100644
--- a/actions/setup/sh/sanitize_path.sh
+++ b/actions/setup/sh/sanitize_path.sh
@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+set +o histexpand
+
 # Sanitize PATH by removing empty elements, leading/trailing colons
 # Usage: source sanitize_path.sh <raw_path>
 #   or:  . sanitize_path.sh <raw_path>
diff --git a/actions/setup/sh/sanitize_path_test.sh b/actions/setup/sh/sanitize_path_test.sh
index c2c3edbbb6d..16ddc98c2d5 100644
--- a/actions/setup/sh/sanitize_path_test.sh
+++ b/actions/setup/sh/sanitize_path_test.sh
@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+set +o histexpand
+
 # Tests for sanitize_path.sh
 # Run: bash sanitize_path_test.sh
 
diff --git a/actions/setup/sh/save_base_github_folders.sh b/actions/setup/sh/save_base_github_folders.sh
index 86960c9c6be..7cb96d1ef28 100644
--- a/actions/setup/sh/save_base_github_folders.sh
+++ b/actions/setup/sh/save_base_github_folders.sh
@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+set +o histexpand
+
 #
 # save_base_github_folders.sh - Snapshot agent config folders/files from the workspace
 #
diff --git a/actions/setup/sh/save_base_github_folders_test.sh b/actions/setup/sh/save_base_github_folders_test.sh
index 5ea6ee69040..e18d59afba5 100644
--- a/actions/setup/sh/save_base_github_folders_test.sh
+++ b/actions/setup/sh/save_base_github_folders_test.sh
@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+set +o histexpand
+
 # Tests for save_base_github_folders.sh
 # Run: bash save_base_github_folders_test.sh
 
diff --git a/actions/setup/sh/setup_cache_memory_git.sh b/actions/setup/sh/setup_cache_memory_git.sh
index c15d5ecffd2..402eabe29e4 100644
--- a/actions/setup/sh/setup_cache_memory_git.sh
+++ b/actions/setup/sh/setup_cache_memory_git.sh
@@ -1,4 +1,6 @@
 #!/bin/bash
+set +o histexpand
+
 # setup_cache_memory_git.sh
 # Pre-agent git setup for integrity-aware cache-memory.
 #
diff --git a/actions/setup/sh/setup_cache_memory_git_test.sh b/actions/setup/sh/setup_cache_memory_git_test.sh
index cdab13c42df..c6269f10613 100644
--- a/actions/setup/sh/setup_cache_memory_git_test.sh
+++ b/actions/setup/sh/setup_cache_memory_git_test.sh
@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+set +o histexpand
+
 # Tests for setup_cache_memory_git.sh — pre-agent sanitization block
 # Run: bash setup_cache_memory_git_test.sh
 
diff --git a/actions/setup/sh/start_cli_proxy.sh b/actions/setup/sh/start_cli_proxy.sh
index dd2b8b01743..da104b16b54 100644
--- a/actions/setup/sh/start_cli_proxy.sh
+++ b/actions/setup/sh/start_cli_proxy.sh
@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+set +o histexpand
+
 # Start DIFC proxy on the host for AWF CLI proxy sidecar
 # This script starts the awmg proxy container so AWF's cli-proxy container
 # can connect to it via host.docker.internal:18443 for gh CLI access.
diff --git a/actions/setup/sh/start_difc_proxy.sh b/actions/setup/sh/start_difc_proxy.sh
index 7185cc971f1..3016e3e9697 100644
--- a/actions/setup/sh/start_difc_proxy.sh
+++ b/actions/setup/sh/start_difc_proxy.sh
@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+set +o histexpand
+
 # Start DIFC proxy for pre-agent gh CLI steps
 # This script starts the awmg proxy container that routes gh CLI calls
 # through DIFC integrity filtering before the agent runs.
diff --git a/actions/setup/sh/start_mcp_gateway.sh b/actions/setup/sh/start_mcp_gateway.sh
index 03e7a8c2f58..e3e3aeb2f09 100755
--- a/actions/setup/sh/start_mcp_gateway.sh
+++ b/actions/setup/sh/start_mcp_gateway.sh
@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+set +o histexpand
+
 # Start MCP Gateway
 # This script starts the MCP gateway process that proxies MCP servers through a unified HTTP endpoint
 # Following the MCP Gateway Specification: https://github.com/github/gh-aw/blob/main/docs/src/content/docs/reference/mcp-gateway.md
diff --git a/actions/setup/sh/start_mcp_gateway_test.sh b/actions/setup/sh/start_mcp_gateway_test.sh
index 2712646be53..fe8906cdc1e 100755
--- a/actions/setup/sh/start_mcp_gateway_test.sh
+++ b/actions/setup/sh/start_mcp_gateway_test.sh
@@ -1,4 +1,6 @@
 #!/bin/bash
+set +o histexpand
+
 # Test script for start_mcp_gateway.sh
 set -e
 
diff --git a/actions/setup/sh/start_mcp_scripts_server.sh b/actions/setup/sh/start_mcp_scripts_server.sh
index 542baad04f3..7315e633b3f 100755
--- a/actions/setup/sh/start_mcp_scripts_server.sh
+++ b/actions/setup/sh/start_mcp_scripts_server.sh
@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+set +o histexpand
+
 # Start MCP Scripts HTTP Server
 # This script starts the mcp-scripts MCP server and waits for it to become ready
 
diff --git a/actions/setup/sh/start_safe_outputs_server.sh b/actions/setup/sh/start_safe_outputs_server.sh
index 93d6d3c8bc8..7eb25ae2d53 100755
--- a/actions/setup/sh/start_safe_outputs_server.sh
+++ b/actions/setup/sh/start_safe_outputs_server.sh
@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+set +o histexpand
+
 # Start Safe Outputs MCP HTTP Server
 # This script starts the safe-outputs MCP server and waits for it to become ready
 
diff --git a/actions/setup/sh/stop_cli_proxy.sh b/actions/setup/sh/stop_cli_proxy.sh
index 77e7c149a66..54250cda363 100644
--- a/actions/setup/sh/stop_cli_proxy.sh
+++ b/actions/setup/sh/stop_cli_proxy.sh
@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+set +o histexpand
+
 # Stop CLI proxy container after AWF execution
 # This script removes the awmg-cli-proxy container started by start_cli_proxy.sh.
 
diff --git a/actions/setup/sh/stop_difc_proxy.sh b/actions/setup/sh/stop_difc_proxy.sh
index 4f3d3a43985..9fe58fa48c0 100644
--- a/actions/setup/sh/stop_difc_proxy.sh
+++ b/actions/setup/sh/stop_difc_proxy.sh
@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+set +o histexpand
+
 # Stop DIFC proxy for pre-agent gh CLI steps
 # This script stops the awmg proxy container and removes the proxy CA certificate
 # from the system trust store (if it was installed).
diff --git a/actions/setup/sh/stop_mcp_gateway.sh b/actions/setup/sh/stop_mcp_gateway.sh
index 25e6f367ce8..26001f42bbd 100755
--- a/actions/setup/sh/stop_mcp_gateway.sh
+++ b/actions/setup/sh/stop_mcp_gateway.sh
@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+set +o histexpand
+
 # Stop MCP Gateway
 # This script stops the MCP gateway process using the /close endpoint for graceful shutdown,
 # falling back to kill signals if the endpoint is unavailable or fails.
diff --git a/actions/setup/sh/validate_gatewayed_server.sh b/actions/setup/sh/validate_gatewayed_server.sh
index cd68a520034..273ee736269 100755
--- a/actions/setup/sh/validate_gatewayed_server.sh
+++ b/actions/setup/sh/validate_gatewayed_server.sh
@@ -1,4 +1,6 @@
 #!/bin/bash
+set +o histexpand
+
 set -e
 
 # validate_gatewayed_server.sh - Validate that an MCP server is correctly gatewayed
diff --git a/actions/setup/sh/validate_gatewayed_server_test.sh b/actions/setup/sh/validate_gatewayed_server_test.sh
index 921203a53ea..c3799eb1b14 100755
--- a/actions/setup/sh/validate_gatewayed_server_test.sh
+++ b/actions/setup/sh/validate_gatewayed_server_test.sh
@@ -1,4 +1,6 @@
 #!/bin/bash
+set +o histexpand
+
 # Test script for validate_gatewayed_server.sh
 set -e
 
diff --git a/actions/setup/sh/validate_multi_secret.sh b/actions/setup/sh/validate_multi_secret.sh
index 196779e4406..1d6cc6f52de 100755
--- a/actions/setup/sh/validate_multi_secret.sh
+++ b/actions/setup/sh/validate_multi_secret.sh
@@ -1,4 +1,6 @@
 #!/bin/bash
+set +o histexpand
+
 set -e
 
 # validate_multi_secret.sh - Validate that at least one secret from a list is configured
diff --git a/actions/setup/sh/validate_prompt_placeholders.sh b/actions/setup/sh/validate_prompt_placeholders.sh
index d7b9eec86e8..53af7af3fc3 100755
--- a/actions/setup/sh/validate_prompt_placeholders.sh
+++ b/actions/setup/sh/validate_prompt_placeholders.sh
@@ -1,4 +1,6 @@
 #!/bin/bash
+set +o histexpand
+
 # Validate that all expression placeholders have been properly substituted
 # This script checks that the prompt file doesn't contain any unreplaced placeholders
 
diff --git a/actions/setup/sh/validate_prompt_placeholders_test.sh b/actions/setup/sh/validate_prompt_placeholders_test.sh
index b3407475bb8..f2d3f7de628 100755
--- a/actions/setup/sh/validate_prompt_placeholders_test.sh
+++ b/actions/setup/sh/validate_prompt_placeholders_test.sh
@@ -1,4 +1,6 @@
 #!/bin/bash
+set +o histexpand
+
 # Test script for validate_prompt_placeholders.sh
 
 set -e
diff --git a/actions/setup/sh/verify_mcp_gateway_health.sh b/actions/setup/sh/verify_mcp_gateway_health.sh
index d56ba758402..f6fee521b95 100755
--- a/actions/setup/sh/verify_mcp_gateway_health.sh
+++ b/actions/setup/sh/verify_mcp_gateway_health.sh
@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+set +o histexpand
+
 # Verify MCP Gateway Health
 # This script verifies that the MCP gateway is running and healthy
 
diff --git a/install-gh-aw.sh b/install-gh-aw.sh
index 9e529ff4332..63bd5a405a5 100755
--- a/install-gh-aw.sh
+++ b/install-gh-aw.sh
@@ -1,4 +1,6 @@
 #!/bin/bash
+set +o histexpand
+
 
 # Script to download and install gh-aw binary for the current OS and architecture
 # Supports: Linux, macOS (Darwin), FreeBSD, Windows (Git Bash/MSYS/Cygwin)
diff --git a/scripts/apply-astro-conversion.sh b/scripts/apply-astro-conversion.sh
index 4d7096f4d5a..6efa197ad52 100755
--- a/scripts/apply-astro-conversion.sh
+++ b/scripts/apply-astro-conversion.sh
@@ -1,4 +1,6 @@
 #!/bin/bash
+set +o histexpand
+
 # Apply Astro to GFM conversion to all docs files
 # Usage: ./scripts/apply-astro-conversion.sh
 
diff --git a/scripts/build-release.sh b/scripts/build-release.sh
index dbfeb051670..4b0ea9e86a0 100755
--- a/scripts/build-release.sh
+++ b/scripts/build-release.sh
@@ -1,4 +1,6 @@
 #!/bin/bash
+set +o histexpand
+
 # Custom build script for gh-extension-precompile to set version correctly
 # This script is called during the release process to build binaries with proper version info
 set -e
diff --git a/scripts/bundle-wasm-docs.sh b/scripts/bundle-wasm-docs.sh
index 466b22b0117..2502417d95b 100755
--- a/scripts/bundle-wasm-docs.sh
+++ b/scripts/bundle-wasm-docs.sh
@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+set +o histexpand
+
 #
 # bundle-wasm-docs.sh -- Build the WebAssembly compiler and copy
 # artifacts into the Astro docs site's public directory.
diff --git a/scripts/check-file-sizes.sh b/scripts/check-file-sizes.sh
index 4f6659c57a7..948dcca967e 100755
--- a/scripts/check-file-sizes.sh
+++ b/scripts/check-file-sizes.sh
@@ -1,4 +1,6 @@
 #!/bin/bash
+set +o histexpand
+
 # check-file-sizes.sh - Monitor Go file sizes and function counts
 #
 # This script identifies Go files that exceed recommended thresholds:
diff --git a/scripts/check-safe-outputs-conformance.sh b/scripts/check-safe-outputs-conformance.sh
index 90f9938a577..8bc6fbde0bf 100755
--- a/scripts/check-safe-outputs-conformance.sh
+++ b/scripts/check-safe-outputs-conformance.sh
@@ -1,4 +1,6 @@
 #!/bin/bash
+set +o histexpand
+
 # Safe Outputs Specification Conformance Checker
 # This script implements automated checks for the Safe Outputs specification
 # Specification: docs/src/content/docs/reference/safe-outputs-specification.md
diff --git a/scripts/check-validator-sizes.sh b/scripts/check-validator-sizes.sh
index 017ba94a8ed..0aff84ef278 100755
--- a/scripts/check-validator-sizes.sh
+++ b/scripts/check-validator-sizes.sh
@@ -1,4 +1,6 @@
 #!/bin/bash
+set +o histexpand
+
 # check-validator-sizes.sh - Enforce the 512-line hard limit on validator files
 #
 # This script finds any *_validation.go file that exceeds the limit and reports it.
diff --git a/scripts/compare-test-coverage.sh b/scripts/compare-test-coverage.sh
index cf368c09800..18cb39e3fcf 100755
--- a/scripts/compare-test-coverage.sh
+++ b/scripts/compare-test-coverage.sh
@@ -1,4 +1,6 @@
 #!/bin/bash
+set +o histexpand
+
 # Compare all tests vs executed tests to find any missing test coverage
 # This ensures all tests are being run in CI unless explicitly skipped
 
diff --git a/scripts/convert-astro-to-gfm.sh b/scripts/convert-astro-to-gfm.sh
index 72674622e01..10330bbb646 100755
--- a/scripts/convert-astro-to-gfm.sh
+++ b/scripts/convert-astro-to-gfm.sh
@@ -1,4 +1,6 @@
 #!/bin/bash
+set +o histexpand
+
 # Convert Astro adornments to GitHub Flavored Markdown alerts
 # Usage: ./scripts/convert-astro-to-gfm.sh <file>
 
diff --git a/scripts/delete-old-copilot-branches.sh b/scripts/delete-old-copilot-branches.sh
index 5b989bbe65f..6ae66637c70 100755
--- a/scripts/delete-old-copilot-branches.sh
+++ b/scripts/delete-old-copilot-branches.sh
@@ -1,4 +1,6 @@
 #!/bin/bash
+set +o histexpand
+
 # delete-old-copilot-branches.sh - Find and delete old copilot/* branches
 #
 # This script identifies copilot/* branches that:
diff --git a/scripts/extract-executed-tests.sh b/scripts/extract-executed-tests.sh
index 15c12722a32..bb04b18fc41 100755
--- a/scripts/extract-executed-tests.sh
+++ b/scripts/extract-executed-tests.sh
@@ -1,4 +1,6 @@
 #!/bin/bash
+set +o histexpand
+
 # Extract executed test names from JSON test result files
 # Parses the JSON output from 'go test -json' format
 
diff --git a/scripts/generate-video-posters.sh b/scripts/generate-video-posters.sh
index 0c85febdf23..e5216f216b2 100755
--- a/scripts/generate-video-posters.sh
+++ b/scripts/generate-video-posters.sh
@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+set +o histexpand
+
 set -e
 
 # Script to generate web-optimized poster images from videos in docs/public/videos
diff --git a/scripts/list-all-tests.sh b/scripts/list-all-tests.sh
index 476df25a6df..9b5299b1a87 100755
--- a/scripts/list-all-tests.sh
+++ b/scripts/list-all-tests.sh
@@ -1,4 +1,6 @@
 #!/bin/bash
+set +o histexpand
+
 # List all Go test function names that are actually runnable
 # This script uses 'go test -list' to discover tests, which respects build tags
 
diff --git a/scripts/report-test-failures.sh b/scripts/report-test-failures.sh
index 7c19c6e29a0..d741f5fdc7e 100755
--- a/scripts/report-test-failures.sh
+++ b/scripts/report-test-failures.sh
@@ -1,4 +1,6 @@
 #!/bin/bash
+set +o histexpand
+
 # Report test failures from JSON test result files
 # Parses the JSON output from 'go test -json' format and prints failure details
 
diff --git a/scripts/report-test-failures_test.sh b/scripts/report-test-failures_test.sh
index e172b789b42..790e3cec229 100755
--- a/scripts/report-test-failures_test.sh
+++ b/scripts/report-test-failures_test.sh
@@ -1,4 +1,6 @@
 #!/bin/bash
+set +o histexpand
+
 # Test script for report-test-failures.sh
 
 set -euo pipefail
diff --git a/scripts/test-build-release.sh b/scripts/test-build-release.sh
index 5a791e40934..20adf9bdfca 100755
--- a/scripts/test-build-release.sh
+++ b/scripts/test-build-release.sh
@@ -1,4 +1,6 @@
 #!/bin/bash
+set +o histexpand
+
 # Test script to validate the build-release.sh script
 set -e
 
diff --git a/scripts/test-install-script.sh b/scripts/test-install-script.sh
index dda5793f6fd..3bbcbbe4919 100755
--- a/scripts/test-install-script.sh
+++ b/scripts/test-install-script.sh
@@ -1,4 +1,6 @@
 #!/bin/bash
+set +o histexpand
+
 # Test script to validate the install-gh-aw.sh script detection logic
 set -e
 
diff --git a/skills/github-discussion-query/query-discussions.sh b/skills/github-discussion-query/query-discussions.sh
index a6497960244..69dca4f8f0e 100755
--- a/skills/github-discussion-query/query-discussions.sh
+++ b/skills/github-discussion-query/query-discussions.sh
@@ -1,4 +1,6 @@
 #!/bin/bash
+set +o histexpand
+
 # Query GitHub discussions with jq filtering support
 #
 # Usage: ./query-discussions.sh [OPTIONS]
diff --git a/skills/github-issue-query/query-issues.sh b/skills/github-issue-query/query-issues.sh
index 68cd955f857..a240a86b6bf 100755
--- a/skills/github-issue-query/query-issues.sh
+++ b/skills/github-issue-query/query-issues.sh
@@ -1,4 +1,6 @@
 #!/bin/bash
+set +o histexpand
+
 # Query GitHub issues with jq filtering support
 #
 # Usage: ./query-issues.sh [OPTIONS]
diff --git a/skills/github-pr-query/query-prs.sh b/skills/github-pr-query/query-prs.sh
index d04a949aec3..10cc3398385 100755
--- a/skills/github-pr-query/query-prs.sh
+++ b/skills/github-pr-query/query-prs.sh
@@ -1,4 +1,6 @@
 #!/bin/bash
+set +o histexpand
+
 # Query GitHub pull requests with jq filtering support
 #
 # Usage: ./query-prs.sh [OPTIONS]
diff --git a/socials/scripts.sh b/socials/scripts.sh
index 00838086df5..e162be31fbf 100644
--- a/socials/scripts.sh
+++ b/socials/scripts.sh
@@ -1,4 +1,6 @@
 #!/bin/bash
+set +o histexpand
+
 set -euo pipefail
 
 # Social Media Campaign Automation Script
diff --git a/test-setup-local.sh b/test-setup-local.sh
index 063ccf56090..96a58a891fd 100755
--- a/test-setup-local.sh
+++ b/test-setup-local.sh
@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+set +o histexpand
+
 # Local test script for setup.sh
 # This script tests the setup action locally to ensure it works correctly