[log] Add debug logging to internal/jqutil/secure.go

[github-actions]

Summary

Adds a debug logger to internal/jqutil/secure.go, a leaf utility package (no existing logger) that centralizes shared gojq compiler options and parse-error formatting used by both internal/config and internal/middleware.

Changes

• Added logger declaration: var log = logger.New("jqutil:secure")
• ParseErrorDetails: logs whether the error wraps a *gojq.ParseError, and logs the resolved offset/token on success
• CompileOptsWithVariables: logs the number of variables used to build compiler options

Validation

• go build ./... — passes
• go vet ./internal/jqutil/... — passes
• go test ./internal/jqutil/... — all 8 tests pass
• go test ./internal/config/... ./internal/middleware/... (dependents) — pass
• gofmt -l — no issues

No unrelated files were modified.

Generated by Go Logger Enhancement · auto · 146.5 AIC · ⊞ 12.4K · ◷

[Copilot]

Pull request overview

Adds debug logging around shared gojq parsing and compiler-option construction.

Changes:

• Adds a jqutil debug logger.
• Logs parse-error details and variable counts.

Show a summary per file

File	Description
internal/jqutil/secure.go	Adds diagnostic logging to jq utilities.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 1/1 changed files
• Comments generated: 1
• Review effort level: Balanced

[github-actions]

🔒 mcpg Read-Only Stress — default AWF

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: default AWF (normal container isolation)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (list_issues/PRs/commits, get_file)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	Error[-32602]: unknown tool (gateway filtered)	BLOCKED	✅
C	CLI	reads (github list_issues)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	blocked: gh unauthenticated (no GH_TOKEN)	BLOCKED	✅
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	blocked: gh unauthenticated (no GH_TOKEN)	BLOCKED	✅

Overall: PASS

Notes:

• All Part B MCP write tool calls returned gateway MCP error [-32602]: unknown tool — the gateway actively removes write tools from its exposed tool list, enforcing read-only at the MCP protocol layer.
• gh CLI is not authenticated in this sandbox (no GH_TOKEN), so all REST/GraphQL write attempts via gh were rejected at auth, providing a defense-in-depth block.
• Run: §30916985255

🔒 mcpg read-only stress (default AWF runtime) by Read-Only Stress: default runtime

[github-actions]

🔒 mcpg Read-Only Stress — gVisor

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: gVisor (runsc) kernel-level isolation

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (list_issues, list_prs, get_file_contents, list_commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	unknown tool [-32602]	BLOCKED	✅
C	CLI	reads via proxy (list_issues, get_file_contents)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	gh unauthenticated — refused	BLOCKED	✅
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	gh unauthenticated — refused	BLOCKED	✅

Overall: PASS

Part B write tools absent from gateway-filtered tool set — MCP error [-32602]: unknown tool on all 7 write attempts. Parts D/E: gh CLI unauthenticated; all REST and GraphQL writes refused at CLI layer.

References: §30916987072

🔒 mcpg read-only stress (gVisor runtime) by Read-Only Stress: gVisor runtime

[github-actions]

🔒 mcpg Read-Only Stress — docker-sbx

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: docker-sbx (KVM-isolated microVM)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	all refused: unknown tool [-32602] (gateway allowlist)	BLOCKED	✅
C	CLI	reads	data returned	ALLOWED	✅
D	CLI	REST writes	all refused: gh unauthenticated	BLOCKED	✅
E	CLI	GraphQL mutations	all refused: gh unauthenticated	BLOCKED	✅

Overall: PASS ✅

Run: §30916988670

🔒 mcpg read-only stress (docker-sbx runtime) by Read-Only Stress: docker-sbx runtime