perf: exclude browser tools and reduce turns in smoke-copilot

.github/workflows/smoke-copilot.md

@@ -22,7 +22,7 @@ tools:
   bash:
     - "*"
   github:
-    toolsets: [repos, pull_requests]
+    toolsets: [pull_requests]
 safe-outputs:
   add-comment:
     hide-older-comments: true
@@ -100,7 +100,7 @@ post-steps:
 The following tests were already executed in a deterministic pre-agent step. Your job is to verify the results and produce the summary comment.
 
 ### 1. GitHub MCP Testing
-The last 2 merged pull requests have been fetched. Verify MCP connectivity by calling `github-list_pull_requests` for ${{ github.repository }} (limit 1, state merged) and confirm data is returned.
+Verify MCP connectivity by calling `github-list_pull_requests` for ${{ github.repository }} (limit 1, state merged). Confirm the result matches the pre-fetched data below.
 
 ### 2. GitHub.com Connectivity
 Pre-step result: HTTP ${{ steps.smoke-data.outputs.SMOKE_HTTP_CODE }} from github.com.
@@ -111,9 +111,6 @@ Pre-step wrote and read back: "${{ steps.smoke-data.outputs.SMOKE_FILE_CONTENT }
 File path: ${{ steps.smoke-data.outputs.SMOKE_FILE_PATH }}
 Verify by running `cat` on the file path using bash to confirm it exists.
 
-### 4. Bash Tool Testing
-Run a simple bash command (e.g., `echo "bash works"`) to verify the bash tool is functional.
-
 ## Pre-Fetched PR Data
 
 ```

scripts/ci/postprocess-smoke-workflows.ts

@@ -244,6 +244,37 @@ for (const workflowPath of workflowPaths) {
     console.log(`  Replaced ${imageTagMatches.length} --image-tag/--skip-pull with --build-local`);
   }
 
+  // Exclude unused Playwright/browser tools from Copilot CLI for smoke-copilot.
+  // The Copilot CLI includes 21 built-in browser_* tools when --allow-all-tools is set.
+  // These tools are never used in smoke-copilot but add ~10,500 tokens/turn of dead weight.
+  // We inject --excluded-tools after --allow-all-tools to suppress them.
+  const isCopilotSmoke = workflowPath.includes('smoke-copilot.lock.yml');
+  if (isCopilotSmoke) {
+    const excludedToolsFlag =
+      '--excluded-tools=browser_close,browser_resize,browser_console_messages,' +
+      'browser_handle_dialog,browser_evaluate,browser_file_upload,browser_fill_form,' +
+      'browser_press_key,browser_type,browser_navigate,browser_navigate_back,' +
+      'browser_network_requests,browser_run_code,browser_take_screenshot,' +
+      'browser_snapshot,browser_click,browser_drag,browser_hover,' +
+      'browser_select_option,browser_tabs,browser_wait_for';
+    // First, strip any existing --excluded-tools flag to make this idempotent
+    const existingExcludedRegex = / --excluded-tools=[^\s'"]*/g;
+    const existingMatches = content.match(existingExcludedRegex);
+    if (existingMatches) {
+      content = content.replace(existingExcludedRegex, '');
+      console.log(`  Removed ${existingMatches.length} existing --excluded-tools flag(s)`);
+    }
+    const allowAllToolsCount = (content.match(/--allow-all-tools/g) || []).length;
+    if (allowAllToolsCount > 0) {
+      content = content.replace(
+        /--allow-all-tools/g,
+        `--allow-all-tools ${excludedToolsFlag}`
+      );
+      modified = true;
+      console.log(`  Injected --excluded-tools (21 browser tools) in ${allowAllToolsCount} location(s)`);
+    }
+  }
+
   // Remove unused "Setup Scripts" step from update_cache_memory jobs.
   // The step downloads a private action but is never used in these jobs,
   // causing 401 Unauthorized failures when permissions: {} is set.