v0.83.2

🌟 Release Highlights

This release focuses on security hardening, reliability fixes, and developer tooling improvements — with enhanced shell-injection detection, WIF auth regression fixes, and a smarter gh aw add command.

✨ What's New

• Smarter gh aw add: Local skill references are now automatically rewritten to fully-qualified specs on gh aw add, reducing configuration drift and making workflows more portable. (#47690)
• BYOK Ollama support: Added sandbox.agent.default-ai-credits-pricing to fix HTTP 400 errors when using Bring-Your-Own-Key Ollama engines. (#47687)
• Shell-injection linting: The ESLint factory now includes a no-child-process-interpolated-command rule to catch shell-injection command strings at authoring time. (#47555)

🐛 Bug Fixes & Improvements

• WIF auth regression restored: Fixes a v0.82.10 regression where WIF auth mapping support was broken for imported engine definitions. (#47572)
• ARC/DinD runtime path fix: Deferred runtime setup now always relocates generated Node.js to daemon-visible storage, preventing silent failures on ARC runners. (#47561)
• Unnamed checkout steps: Fixed deferred runtime setup for unnamed custom checkout steps. (#47545)
• Close-older-issues guard: Prevents close-older-issues from accidentally closing issues created in the same workflow run. (#47585)
• CLI consistency: Addressed 14 CLI consistency issues across branding, descriptions, and docs. (#47592)
• ESLint variable indirection: Resolved single-level variable indirection in no-exec-interpolated-command. (#47544)
• Command execution hardening: Hardened command execution inputs in git, workflow, and CLI paths. (#47546)

🔧 Internal

• Bumped AWF firewall to v0.27.41 and MCP gateway to v0.4.5
• Replaced gh CLI calls with native go-gh REST clients for release and ref lookups
• Added debug logging to defer-safety linters
• Removed 5 dead functions

📚 Documentation

• Streamlined the orchestration pattern guide for clarity
• Self-healing documentation fixes from automated issue analysis
• Improved spec–implementation alignment across 6 package READMEs

Generated by 🚀 Release · sonnet46 · 14.6 AIC · ⊞ 7.9K

---

What's Changed

• fix(eslint-factory): resolve single-level variable indirection in no-exec-interpolated-command by @pelikhan with @Copilot in #47544
• fix: increase timeout-minutes to 30 for copilot-pr-nlp-analysis workflow by @pelikhan with @Copilot in #47558
• Convert report-as-issue tip to details/progressive disclosure by @pelikhan with @Copilot in #47574
• eslint-factory: add no-child-process-interpolated-command to catch shell-injection command strings by @pelikhan with @Copilot in #47555
• Harden command execution inputs in flagged git, workflow, and CLI paths by @pelikhan with @Copilot in #47546
• Fix 9 spec–implementation mismatches across 6 package READMEs by @pelikhan with @Copilot in #47588
• Add explicit h3 formatting enforcement to 3 non-compliant reporting workflows by @pelikhan with @Copilot in #47593
• fix: prevent close-older-issues from closing issues created in the same run by @pelikhan with @Copilot in #47585
• fix: add generated footer to close_issue comment body by @pelikhan with @Copilot in #47584
• fix: restore WIF auth mapping support for imported engine definitions (v0.82.10 regression) by @pelikhan with @Copilot in #47572
• fix: add · separator between model alias and AIC value in footer by @pelikhan with @Copilot in #47567
• Fix ARC/DinD deferred runtime path to always relocate generated Node.js to daemon-visible storage by @pelikhan with @Copilot in #47561
• Fix deferred runtime setup for unnamed custom checkout steps by @pelikhan with @Copilot in #47545
• [dead-code] chore: remove dead functions — 5 functions removed by @github-actions[bot] in #47598
• [ab-advisor] Add sub_agent_strategy experiment to smoke-copilot-sub-agents by @pelikhan with @Copilot in #47557
• chore: bump AWF to v0.27.39 and MCP gateway to v0.4.4 by @lpcox with @Copilot in #47597
• Use native go-gh REST clients for release and ref lookups by @pelikhan with @Copilot in #47547
• [docs] Self-healing documentation fixes from issue analysis - 2026-07-24 by @github-actions[bot] in #47672
• [docs] docs: unbloat orchestration pattern by @github-actions[bot] in #47677
• [community] Update community contributions in README by @github-actions[bot] in #47689
• Close SPDD conformance gaps for ADRs 27325/27327/27387/27476/27479 by @pelikhan with @Copilot in #47637
• fix: address 14 CLI consistency issues (branding, descriptions, docs) by @pelikhan with @Copilot in #47592
• Targeted custom-lint remediation for non-largefunc findings in CLI/workflow paths by @pelikhan with @Copilot in #47601
• Formal spec alignment for GitHub MCP access-control conformance docs and predicate mapping by @pelikhan with @Copilot in #47633
• [safe-output-integrator] test: add max_bot_mentions coverage to generateSafeOutputsConfig tests by @github-actions[bot] in #47658
• [log] Add debug logging to defer-safety linters by @github-actions[bot] in #47697
• test(actionpins): improve test quality per testify-expert audit by @pelikhan with @Copilot in #47686
• feat: rewrite local skill refs to qualified specs on gh aw add by @pelikhan with @Copilot in #47690
• Bump AWF firewall to v0.27.41 and MCPG to v0.4.5 by @lpcox with @Copilot in #47695
• feat: add sandbox.agent.default-ai-credits-pricing to fix BYOK Ollama HTTP 400 by @pelikhan with @Copilot in #47687

Full Changelog: v0.83.1...v0.83.2