Analyze: update_pull_request with empty args silently drops safe outputs

actions/setup/js/safe_outputs_handlers.cjs

@@ -1359,6 +1359,33 @@ function createHandlers(server, appendSafeOutput, config = {}) {
     };
   };
 
+  /**
+   * Handler for update_pull_request tool
+   * Spec cross-reference: Safe Output Outcome Evaluation §update_pull_request.
+   * Per Safe Outputs Specification MCE1: Enforces constraints during tool invocation
+   * to provide immediate feedback to the LLM before recording to NDJSON.
+   * Validates that at least one of 'title', 'body', or 'update_branch' is provided,
+   * matching the server-side requiresOneOf:title,body,update_branch validation.
+   */
+  const updatePullRequestHandler = args => {
+    const safeArgs = args || {};
+    const hasTitle = safeArgs.title !== undefined;
+    const hasBody = safeArgs.body !== undefined;
+    // update_branch: false is treated as not provided because it carries no update intent
+    // (it's the default behaviour). This mirrors the downstream requiresOneOf validator in
+    // safe_output_type_validator.cjs which also excludes field === false from the count.
+    const hasUpdateBranch = safeArgs.update_branch !== undefined && safeArgs.update_branch !== false;
+
+    if (!hasTitle && !hasBody && !hasUpdateBranch) {
+      throw {
+        code: -32602,
+        message: `${ERR_VALIDATION}: update_pull_request requires at least one of: 'title', 'body', 'update_branch' fields`,
+      };
+    }
+
+    return defaultHandler("update_pull_request")(safeArgs);
+  };
+
   return {
     defaultHandler,
     uploadAssetHandler,
@@ -1371,6 +1398,7 @@ function createHandlers(server, appendSafeOutput, config = {}) {
     addCommentHandler,
     createPullRequestReviewCommentHandler,
     submitPullRequestReviewHandler,
+    updatePullRequestHandler,
   };
 }
 

actions/setup/js/safe_outputs_handlers.test.cjs

@@ -1764,4 +1764,81 @@ describe("safe_outputs_handlers", () => {
       expect(() => handlers.submitPullRequestReviewHandler({ event: "COMMENT" })).toThrow(expect.objectContaining({ code: -32602, message: expect.stringContaining("review body is empty") }));
     });
   });
+
+  describe("updatePullRequestHandler", () => {
+    it("should throw MCP error when no fields are provided", () => {
+      expect(() => handlers.updatePullRequestHandler({})).toThrow(
+        expect.objectContaining({
+          code: -32602,
+          message: expect.stringContaining("requires at least one of"),
+        })
+      );
+    });
+
+    it("should throw MCP error when called with null/undefined args", () => {
+      expect(() => handlers.updatePullRequestHandler(null)).toThrow(
+        expect.objectContaining({ code: -32602 })
+      );
+      expect(() => handlers.updatePullRequestHandler(undefined)).toThrow(
+        expect.objectContaining({ code: -32602 })
+      );
+    });
+
+    it("should throw MCP error when update_branch is explicitly false and no other fields", () => {
+      expect(() => handlers.updatePullRequestHandler({ update_branch: false })).toThrow(
+        expect.objectContaining({ code: -32602 })
+      );
+    });
+
+    it("should write entry and return success when title is provided", () => {
+      const result = handlers.updatePullRequestHandler({ title: "New Title" });
+      expect(result).toHaveProperty("content");
+      const data = JSON.parse(result.content[0].text);
+      expect(data.result).toBe("success");
+      expect(mockAppendSafeOutput).toHaveBeenCalledWith(
+        expect.objectContaining({ type: "update_pull_request", title: "New Title" })
+      );
+    });
+
+    it("should write entry and return success when body is provided", () => {
+      const result = handlers.updatePullRequestHandler({ body: "Updated body" });
+      expect(result).toHaveProperty("content");
+      const data = JSON.parse(result.content[0].text);
+      expect(data.result).toBe("success");
+      expect(mockAppendSafeOutput).toHaveBeenCalledWith(
+        expect.objectContaining({ type: "update_pull_request", body: "Updated body" })
+      );
+    });
+
+    it("should write entry and return success when update_branch is true", () => {
+      const result = handlers.updatePullRequestHandler({ update_branch: true });
+      expect(result).toHaveProperty("content");
+      const data = JSON.parse(result.content[0].text);
+      expect(data.result).toBe("success");
+      expect(mockAppendSafeOutput).toHaveBeenCalledWith(
+        expect.objectContaining({ type: "update_pull_request", update_branch: true })
+      );
+    });
+
+    it("should write entry and return success when both title and body are provided", () => {
+      const result = handlers.updatePullRequestHandler({ title: "New Title", body: "New body" });
+      expect(result).toHaveProperty("content");
+      const data = JSON.parse(result.content[0].text);
+      expect(data.result).toBe("success");
+      expect(mockAppendSafeOutput).toHaveBeenCalledWith(
+        expect.objectContaining({ type: "update_pull_request", title: "New Title", body: "New body" })
+      );
+    });
+
+    it("error message should mention all required fields", () => {
+      try {
+        handlers.updatePullRequestHandler({});
+        expect.fail("Should have thrown");
+      } catch (err) {
+        expect(err.message).toContain("'title'");
+        expect(err.message).toContain("'body'");
+        expect(err.message).toContain("'update_branch'");
+      }
+    });
+  });
 });

actions/setup/js/safe_outputs_tools.json

@@ -799,7 +799,7 @@
   },
   {
     "name": "update_pull_request",
-    "description": "Update an existing GitHub pull request's title or body. Supports replacing, appending to, or prepending content to the body. Title is always replaced. Only the fields you specify will be updated; other fields remain unchanged.",
+    "description": "Update an existing GitHub pull request's title or body. Supports replacing, appending to, or prepending content to the body. Title is always replaced. Only the fields you specify will be updated; other fields remain unchanged. IMPORTANT: At least one of 'title', 'body', or 'update_branch' must be provided; calling this tool with no fields will return an error.",
     "inputSchema": {
       "type": "object",
       "properties": {

actions/setup/js/safe_outputs_tools_loader.cjs

@@ -82,6 +82,7 @@ function attachHandlers(tools, handlers) {
     add_comment: handlers.addCommentHandler,
     create_pull_request_review_comment: handlers.createPullRequestReviewCommentHandler,
     submit_pull_request_review: handlers.submitPullRequestReviewHandler,
+    update_pull_request: handlers.updatePullRequestHandler,
   };
 
   tools.forEach(tool => {

pkg/workflow/js/safe_outputs_tools.json

@@ -943,7 +943,7 @@
   },
   {
     "name": "update_pull_request",
-    "description": "Update an existing GitHub pull request's title or body. Supports replacing, appending to, or prepending content to the body. Title is always replaced. Only the fields you specify will be updated; other fields remain unchanged.",
+    "description": "Update an existing GitHub pull request's title or body. Supports replacing, appending to, or prepending content to the body. Title is always replaced. Only the fields you specify will be updated; other fields remain unchanged. IMPORTANT: At least one of 'title', 'body', or 'update_branch' must be provided; calling this tool with no fields will return an error.",
     "inputSchema": {
       "type": "object",
       "properties": {