Fix Copilot review feedback for PowerShell dev actions

ts/packages/agentSdk/src/action.ts

@@ -35,6 +35,13 @@ export type SerializedError = {
 export type ActionResultError = {
     error: string;
     fallbackToReasoning?: boolean | undefined;
+    // Stable machine-readable code for callers that need policy or retry
+    // decisions without parsing the display message.
+    errorCode?: string | undefined;
+    // Whether the caller may safely retry after changing the action.
+    retryable?: boolean | undefined;
+    // True when the failed action may already have changed external state.
+    mayHaveSideEffects?: boolean | undefined;
     // Rich display to show in place of the plain `error` text (e.g. setup
     // instructions with a config snippet, which need markdown to survive
     // rendering). Optional — clients fall back to `error` when absent.

ts/packages/agents/powershell/benchmark/scenarios/dev-actions-routing.json

@@ -31,7 +31,7 @@
   {
     "id": "dev-route-02",
     "category": "dev-actions-routing",
-    "description": "PowerShell schema family includes the root flow schema",
+    "description": "PowerShell schema family includes the files namespace",
     "required": true,
     "setup": {
       "requiredFlows": ["listFiles"]
@@ -51,7 +51,7 @@
           "disposition": {
             "status": "handled",
             "path": "action",
-            "schemas": ["powershell"]
+            "schemas": ["powershell.powershell-files"]
           }
         }
       }

ts/packages/agents/powershell/scripts/scriptHost.ps1

@@ -50,7 +50,8 @@ try {
     $expandedAllowedPaths = @()
     foreach ($ap in $AllowedPaths) {
         try {
-            $expandedAllowedPaths += $ExecutionContext.InvokeCommand.ExpandString($ap)
+            $expandedPath = $ExecutionContext.InvokeCommand.ExpandString($ap)
+            $expandedAllowedPaths += [System.IO.Path]::GetFullPath($expandedPath).TrimEnd('\', '/')
         } catch {
             $expandedAllowedPaths += $ap
         }
@@ -77,11 +78,21 @@ try {
                 try { $isValidPath = Test-Path $val -IsValid } catch { }
                 if ($isValidPath) {
                     $resolvedPath = $null
-                    try { $resolvedPath = (Resolve-Path $val -ErrorAction SilentlyContinue).Path } catch {}
+                    try {
+                        $resolvedPath = (Resolve-Path $val -ErrorAction SilentlyContinue).Path
+                        if (-not $resolvedPath) {
+                            $resolvedPath = [System.IO.Path]::GetFullPath($val)
+                        }
+                        $resolvedPath = $resolvedPath.TrimEnd('\', '/')
+                    } catch {}
                     if ($resolvedPath) {
                         $pathAllowed = $false
                         foreach ($ap in $expandedAllowedPaths) {
-                            if ($resolvedPath -like "$ap*") {
+                            if (
+                                $resolvedPath.Equals($ap, [System.StringComparison]::OrdinalIgnoreCase) -or
+                                $resolvedPath.StartsWith("$ap\", [System.StringComparison]::OrdinalIgnoreCase) -or
+                                $resolvedPath.StartsWith("$ap/", [System.StringComparison]::OrdinalIgnoreCase)
+                            ) {
                                 $pathAllowed = $true
                                 break
                             }