Disable shell history expansion for bash scripts and MCP CLI wrappers

.devcontainer/setup.sh

@@ -1,4 +1,6 @@
 #!/bin/bash
+set +o histexpand
+
 
 # install project dependencies
 make deps

actions/setup-cli/install_test.sh

@@ -1,4 +1,6 @@
 #!/bin/bash
+set +o histexpand
+
 # Test script for install.sh in setup-cli action
 set -e
 

actions/setup/clean.sh

@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+set +o histexpand
+
 # Clean Action Post Script
 # Mirror of actions/setup/post.js for script mode (run: bash steps).
 # Sends an OTLP conclusion span then removes the /tmp/gh-aw/ directory.

actions/setup/js/mount_mcp_as_cli.cjs

@@ -289,6 +289,8 @@ function generateCLIWrapperScript(serverName, serverUrl, toolsFile, apiKey, brid
   const safeBridge = shellEscapeDoubleQuoted(bridgeScript);
 
   return `#!/usr/bin/env bash
+set +o histexpand
+
 # MCP CLI wrapper for: ${safeName}
 # Auto-generated by gh-aw. Do not modify.
 #

actions/setup/setup.sh

@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+set +o histexpand
+
 # Setup Action
 # Copies activation job files to the agent environment
 #

actions/setup/sh/append_agent_step_summary.sh

@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+set +o histexpand
+
 # Append the agent's step summary to the real $GITHUB_STEP_SUMMARY.
 # The file was written by the agent and already redacted for secrets.
 # This is a no-op when the file is empty (agent wrote nothing).

actions/setup/sh/check_mcp_servers.sh

@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+set +o histexpand
+
 # Check MCP Server Functionality
 # This script performs basic functionality checks on MCP servers configured by the MCP gateway
 # It sends an MCP ping + initialize + tools/list request to each server to verify backend connectivity

actions/setup/sh/check_mcp_servers_test.sh

@@ -1,4 +1,6 @@
 #!/bin/bash
+set +o histexpand
+
 # Test script for check_mcp_servers.sh
 set -e
 

actions/setup/sh/clean_git_credentials.sh

@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+set +o histexpand
+
 #
 # clean_git_credentials.sh - Remove git credentials from all git checkouts
 #

actions/setup/sh/clean_git_credentials_test.sh

@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+set +o histexpand
+
 # Test script for clean_git_credentials.sh
 # Run: bash clean_git_credentials_test.sh
 

actions/setup/sh/clone_repo_memory_branch.sh

@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+set +o histexpand
+
 # Clone repo-memory branch script
 # Clones a repo-memory branch or creates an orphan branch if it doesn't exist
 #

actions/setup/sh/commit_cache_memory_git.sh

@@ -1,4 +1,6 @@
 #!/bin/bash
+set +o histexpand
+
 # commit_cache_memory_git.sh
 # Post-agent git commit for integrity-aware cache-memory.
 #

actions/setup/sh/compute_artifact_prefix.sh

@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+set +o histexpand
+
 #
 # compute_artifact_prefix.sh - Compute a stable artifact name prefix for workflow_call runs
 #

actions/setup/sh/configure_gh_for_ghe.sh

@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+set +o histexpand
+
 # Configure gh CLI for GitHub Enterprise
 #
 # This script configures the gh CLI to work with GitHub Enterprise environments

actions/setup/sh/configure_gh_for_ghe_test.sh

@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+set +o histexpand
+
 # Test script for configure_gh_for_ghe.sh
 
 set -e

actions/setup/sh/convert_gateway_config_claude.sh

@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+set +o histexpand
+
 # Convert MCP Gateway Configuration to Claude Format
 # This script converts the gateway's standard HTTP-based MCP configuration
 # to the JSON format expected by Claude (without Copilot-specific fields)

actions/setup/sh/convert_gateway_config_codex.sh

@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+set +o histexpand
+
 # Convert MCP Gateway Configuration to Codex Format
 # This script converts the gateway's standard HTTP-based MCP configuration
 # to the TOML format expected by Codex

actions/setup/sh/convert_gateway_config_codex_test.sh

@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+set +o histexpand
+
 # Test script for convert_gateway_config_codex.sh
 
 set -e

actions/setup/sh/convert_gateway_config_copilot.sh

@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+set +o histexpand
+
 # Convert MCP Gateway Configuration to Copilot Format
 # This script converts the gateway's standard HTTP-based MCP configuration
 # to the format expected by GitHub Copilot CLI

actions/setup/sh/convert_gateway_config_crush.sh

@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+set +o histexpand
+
 # Convert MCP Gateway Configuration to Crush Format
 # This script converts the gateway's standard HTTP-based MCP configuration
 # to the JSON format expected by Crush (.crush.json)

actions/setup/sh/convert_gateway_config_gemini.sh

@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+set +o histexpand
+
 # Convert MCP Gateway Configuration to Gemini Format
 # This script converts the gateway's standard HTTP-based MCP configuration
 # to the JSON format expected by Gemini CLI (.gemini/settings.json)

actions/setup/sh/copy_copilot_session_state.sh

@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+set +o histexpand
+
 # Copy the entire Copilot session-state directory to the agent logs folder
 # for artifact collection. This ensures all session files (events.jsonl,
 # session.db, plan.md, checkpoints, etc.) are in /tmp/gh-aw/ where secret

actions/setup/sh/download_docker_images.sh

@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+set +o histexpand
+
 # Download Docker images with retry logic and controlled parallelism
 # Usage: download_docker_images.sh IMAGE1 [IMAGE2 ...]
 #

actions/setup/sh/download_docker_images_test.sh

@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+set +o histexpand
+
 # Test script for download_docker_images.sh
 # Tests concurrent download functionality
 

actions/setup/sh/install_awf_binary.sh

@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+set +o histexpand
+
 # Install AWF (Agentic Workflow Firewall) with SHA256 checksum verification
 # Usage: install_awf_binary.sh VERSION
 #

actions/setup/sh/install_copilot_cli.sh

@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+set +o histexpand
+
 # Install GitHub Copilot CLI with SHA256 checksum verification
 # Usage: install_copilot_cli.sh [VERSION]
 #

actions/setup/sh/install_docker_macos.sh

@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+set +o histexpand
+
 # Install Docker on macOS GitHub Actions runners via colima
 # Usage: install_docker_macos.sh
 #

actions/setup/sh/install_gh_cli.sh

@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+set +o histexpand
+
 # Install GitHub CLI (gh) if not already present
 #
 # This script installs the GitHub CLI using the official apt repository on

actions/setup/sh/parse_guard_list.sh

@@ -1,4 +1,6 @@
 #!/bin/bash
+set +o histexpand
+
 set -eo pipefail
 
 # parse_guard_list.sh - Parse comma/newline-separated guard policy lists into JSON arrays

actions/setup/sh/restore_base_github_folders.sh

@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+set +o histexpand
+
 #
 # restore_base_github_folders.sh - Restore agent config folders/files from the base
 #                                   branch snapshot after PR checkout

actions/setup/sh/restore_base_github_folders_test.sh

@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+set +o histexpand
+
 # Tests for restore_base_github_folders.sh
 # Run: bash restore_base_github_folders_test.sh
 

actions/setup/sh/sanitize_path.sh

@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+set +o histexpand
+
 # Sanitize PATH by removing empty elements, leading/trailing colons
 # Usage: source sanitize_path.sh <raw_path>
 #   or:  . sanitize_path.sh <raw_path>

actions/setup/sh/sanitize_path_test.sh

@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+set +o histexpand
+
 # Tests for sanitize_path.sh
 # Run: bash sanitize_path_test.sh
 

actions/setup/sh/save_base_github_folders.sh

@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+set +o histexpand
+
 #
 # save_base_github_folders.sh - Snapshot agent config folders/files from the workspace
 #

actions/setup/sh/save_base_github_folders_test.sh

@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+set +o histexpand
+
 # Tests for save_base_github_folders.sh
 # Run: bash save_base_github_folders_test.sh
 

actions/setup/sh/setup_cache_memory_git.sh

@@ -1,4 +1,6 @@
 #!/bin/bash
+set +o histexpand
+
 # setup_cache_memory_git.sh
 # Pre-agent git setup for integrity-aware cache-memory.
 #

actions/setup/sh/setup_cache_memory_git_test.sh

@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+set +o histexpand
+
 # Tests for setup_cache_memory_git.sh — pre-agent sanitization block
 # Run: bash setup_cache_memory_git_test.sh
 

actions/setup/sh/start_cli_proxy.sh

@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+set +o histexpand
+
 # Start DIFC proxy on the host for AWF CLI proxy sidecar
 # This script starts the awmg proxy container so AWF's cli-proxy container
 # can connect to it via host.docker.internal:18443 for gh CLI access.

actions/setup/sh/start_difc_proxy.sh

@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+set +o histexpand
+
 # Start DIFC proxy for pre-agent gh CLI steps
 # This script starts the awmg proxy container that routes gh CLI calls
 # through DIFC integrity filtering before the agent runs.

actions/setup/sh/start_mcp_gateway.sh

@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+set +o histexpand
+
 # Start MCP Gateway
 # This script starts the MCP gateway process that proxies MCP servers through a unified HTTP endpoint
 # Following the MCP Gateway Specification: https://github.com/github/gh-aw/blob/main/docs/src/content/docs/reference/mcp-gateway.md

actions/setup/sh/start_mcp_gateway_test.sh

@@ -1,4 +1,6 @@
 #!/bin/bash
+set +o histexpand
+
 # Test script for start_mcp_gateway.sh
 set -e
 

actions/setup/sh/start_mcp_scripts_server.sh

@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+set +o histexpand
+
 # Start MCP Scripts HTTP Server
 # This script starts the mcp-scripts MCP server and waits for it to become ready
 

actions/setup/sh/start_safe_outputs_server.sh

@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+set +o histexpand
+
 # Start Safe Outputs MCP HTTP Server
 # This script starts the safe-outputs MCP server and waits for it to become ready
 

actions/setup/sh/stop_cli_proxy.sh

@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+set +o histexpand
+
 # Stop CLI proxy container after AWF execution
 # This script removes the awmg-cli-proxy container started by start_cli_proxy.sh.
 

actions/setup/sh/stop_difc_proxy.sh

@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+set +o histexpand
+
 # Stop DIFC proxy for pre-agent gh CLI steps
 # This script stops the awmg proxy container and removes the proxy CA certificate
 # from the system trust store (if it was installed).

actions/setup/sh/stop_mcp_gateway.sh

@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+set +o histexpand
+
 # Stop MCP Gateway
 # This script stops the MCP gateway process using the /close endpoint for graceful shutdown,
 # falling back to kill signals if the endpoint is unavailable or fails.

actions/setup/sh/validate_gatewayed_server.sh

@@ -1,4 +1,6 @@
 #!/bin/bash
+set +o histexpand
+
 set -e
 
 # validate_gatewayed_server.sh - Validate that an MCP server is correctly gatewayed

actions/setup/sh/validate_gatewayed_server_test.sh

@@ -1,4 +1,6 @@
 #!/bin/bash
+set +o histexpand
+
 # Test script for validate_gatewayed_server.sh
 set -e
 

actions/setup/sh/validate_multi_secret.sh

@@ -1,4 +1,6 @@
 #!/bin/bash
+set +o histexpand
+
 set -e
 
 # validate_multi_secret.sh - Validate that at least one secret from a list is configured

actions/setup/sh/validate_prompt_placeholders.sh

@@ -1,4 +1,6 @@
 #!/bin/bash
+set +o histexpand
+
 # Validate that all expression placeholders have been properly substituted
 # This script checks that the prompt file doesn't contain any unreplaced placeholders
 

actions/setup/sh/validate_prompt_placeholders_test.sh

@@ -1,4 +1,6 @@
 #!/bin/bash
+set +o histexpand
+
 # Test script for validate_prompt_placeholders.sh
 
 set -e

actions/setup/sh/verify_mcp_gateway_health.sh

@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+set +o histexpand
+
 # Verify MCP Gateway Health
 # This script verifies that the MCP gateway is running and healthy
 

install-gh-aw.sh

@@ -1,4 +1,6 @@
 #!/bin/bash
+set +o histexpand
+
 
 # Script to download and install gh-aw binary for the current OS and architecture
 # Supports: Linux, macOS (Darwin), FreeBSD, Windows (Git Bash/MSYS/Cygwin)

scripts/apply-astro-conversion.sh

@@ -1,4 +1,6 @@
 #!/bin/bash
+set +o histexpand
+
 # Apply Astro to GFM conversion to all docs files
 # Usage: ./scripts/apply-astro-conversion.sh
 

scripts/build-release.sh

@@ -1,4 +1,6 @@
 #!/bin/bash
+set +o histexpand
+
 # Custom build script for gh-extension-precompile to set version correctly
 # This script is called during the release process to build binaries with proper version info
 set -e