v0.84.1

🌟 Release Highlights

This release focuses on security hardening, safe-outputs flexibility, and a batch of reliability fixes across the compiler, MCP tooling, and CI infrastructure.

✨ What's New

• Per-output GitHub App overrides in safe-outputs — configure a different GitHub App identity per output type for finer-grained write permissions (#49226).
• Bounded queries in workflow frontmatter and AWF configuration — cap query scope directly from frontmatter (#49149).
• Local skill paths via --from-local — reference skills from local paths in frontmatter skills: without publishing them first (#49115).
• pi engine bare mode support — run the pi engine with a leaner, dependency-free mode (#49137).
• grok-4.5 model alias and pricing added to the model registry (#49072).

🐛 Bug Fixes & Improvements

• Fixed gh aw logs silently discarding all processed runs due to a variable-shadowing bug (#49332).
• Fixed TYPE-008 conformance checker permission expectations (#49324).
• Fixed evals judge parser dropping valid YES/NO answers as UNKNOWN for Claude engine output (#49323).
• Restored schema-aware probe detection for zero-arg safeoutputs tools (#49313).
• findWorkflowFile now checks .yaml in addition to .yml (#49230).
• Fixed a 278.8% performance regression in BenchmarkCompileMCPWorkflow (#48967).
• Detached long-running audit/audit-diff and logs subprocesses from the MCP gateway's 60s deadline to prevent premature timeouts (#49061, #48961).
• Added MCE1 egress context validation to 10 safe-output handlers that previously hard-failed on scheduled runs (#49060).
• Cleared all git config scopes before overriding extraheader, preventing duplicate Authorization headers (#49059).
• Enforced three-level version priority for Copilot CLI install (#49116).

🔒 Security

• Hardened the Docker scanner and upgraded re-exec argument validation (#49278).
• Hardened scanner/relaunch exec paths against command and argument injection (#49063).
• Patched bundled tar/brace-expansion CVEs in gh-aw-node and bumped npm to 11.19.0 (#49314).
• Added a new goroutinemissingrecover linter to flag panic-unsafe goroutines (#48966), plus fixed context propagation and goroutine panic recovery in privileged MCP tools (#49031).

📚 Documentation

• Prerendered llms.txt so GitHub Pages now publishes /llms.txt (#49353).
• Distilled MCP pagination guidance into a shared github-mcp-server.md reference and consolidated it across workflows (#49081, #49051).
• Trimmed and clarified the quick-start guide, MCP guide, and command triggers reference (#49259, #49239, #49017).

🔧 Internal

• Refactored 3 agentic workflows to use the rig custom harness (#49000).
• Added t.Parallel() across leaf utility package tests and command group tests for faster CI (#49229, #49080).
• Cached lightweight agentic workflow logs to speed up log analysis (#49082).

No community-labeled issues were closed in this release window.

Generated by 🚀 Release · auto · 17.6 AIC · ⊞ 11K

---

What's Changed

• fix: stop unbounded pagination in check_rate_limit when run exceeds threshold by @pelikhan with @Copilot in #48972
• [WIP] Fix failing GitHub Actions job lint-go by @pelikhan with @Copilot in #48975
• fix(mcp): detach logs subprocess context from MCP gateway 60s deadline by @pelikhan with @Copilot in #48961
• perf: fix 278.8% regression in BenchmarkCompileMCPWorkflow by @pelikhan with @Copilot in #48967
• Add goroutinemissingrecover linter: flag panic-unsafe goroutines by @pelikhan with @Copilot in #48966
• docs: add panic contract doc comment to prepareClaudeToolsForAllowedList by @pelikhan with @Copilot in #48984
• fix: downgrade gosec to v2.27.1 to resolve actionlint yaml/v4 compile failure by @pelikhan with @Copilot in #48979
• Refactor 3 agentic workflows to use rig custom harness by @pelikhan with @Copilot in #49000
• fix(instructions-janitor): pin model, bound git history, add early exit to reduce 40% failure rate by @pelikhan with @Copilot in #48990
• fix(daily-security-observability): pre-download firewall runs to avoid MCP tool timeout by @pelikhan with @Copilot in #48988
• fix(delight): pre-read sampled files to eliminate view/read tool denials by @pelikhan with @Copilot in #48989
• Fixing model name normalizer logic by @pelikhan with @Copilot in #49001
• fix(workflow): set engine.mcp.tool-timeout on daily-safe-output-optimizer by @pelikhan with @Copilot in #49006
• [ubuntu-image] Update Ubuntu runner image analysis to version 20260720.247.2 by @github-actions[bot] in #49037
• [code-simplifier] refactor: dedupe EVENT_TYPE_DESCRIPTIONS constant across comment handlers by @github-actions[bot] in #49035
• [docs] docs: unbloat command triggers reference by @github-actions[bot] in #49017
• [community] Update community contributions in README by @github-actions[bot] in #49026
• [log] Add debug logging to five pkg/linters analyzers by @github-actions[bot] in #49036
• Fix context propagation and goroutine panic recovery in privileged MCP tools by @pelikhan with @Copilot in #49031
• refactor: narrow convertToGitHubActionsEnv env parameter from any to map[string]any by @pelikhan with @Copilot in #48992
• refactor: consolidate MCP pagination guidance via shared/mcp-pagination.md by @pelikhan with @Copilot in #49051
• Enable evals on 20 more agentic workflows by @pelikhan with @Copilot in #49078
• [test-parallel] Add t.Parallel() to command_groups_test.go by @github-actions[bot] in #49080
• docs: distill mcp-pagination strategy into github-mcp-server.md by @pelikhan with @Copilot in #49081
• Mark copilot-sdk mode as stable by @pelikhan with @Copilot in #48978
• fix: skip roles check when slash command not triggered on issue open by @pelikhan with @Copilot in #48991
• fix(eslint): detect inline require('child_process').() in no-child-process-interpolated-command by @pelikhan with @Copilot in #49069
• Add merge conflict resolver skill by @pelikhan in #49093
• fix: increase timeout-minutes to 40 for daily-performance-summary workflow by @pelikhan with @Copilot in #49005
• fix: detach audit/audit-diff subprocess contexts from MCP gateway 60s deadline by @pelikhan with @Copilot in #49061
• fix(byok-ollama): stop systemd service before rebind + non-zero fallback pricing by @pelikhan with @Copilot in #49074
• Add gh-aw-detection: true to 7 high-frequency workflows lacking anomaly/prompt-injection detection by @pelikhan with @Copilot in #49071
• stringsconcatloop: detect x = x + y accumulator pattern alongside += by @pelikhan with @Copilot in #49066
• feat: add grok-4.5 model alias and pricing by @pelikhan with @Copilot in #49072
• [instructions] Sync instruction files with release v0.84.0 by @github-actions[bot] in #49104
• fix: detect max consecutive cache misses exceeded and surface dedicated failure context by @pelikhan with @Copilot in #49070
• fix(update_project): numeric field values now correctly infer NUMBER type by @pelikhan with @Copilot in #49073
• Cache lightweight agentic workflow logs by @pelikhan with @Copilot in #49082
• pr-finisher: resolve Copilot-answered review threads before re-engaging copilot-review by @pelikhan with @Copilot in #49111
• feat: sync compat.json max-agent with DefaultCopilotVersion at build time by @pelikhan with @Copilot in #49113
• [spec-extractor] docs: document ValidateExecutablePath and ResolveExecutablePath in fileutil README by @github-actions[bot] in #49112
• fix: linearize against bundle prerequisite SHA, not moving origin/ tip by @pelikhan with @Copilot in #49002
• fix(safe-outputs): add MCE1 egress context validation to 10 handlers that hard-failed on scheduled runs by @pelikhan with @Copilot in #49060
• [eslint-miner] feat(eslint): add require-escaped-regexp-interpolation rule by @github-actions[bot] in #49106
• [WIP] Fix failing GitHub Actions job Integration: CMD Tests by @pelikhan with @Copilot in #49110
• feat: fail fast on implausible commit range in shallow checkout by @pelikhan with @Copilot in #49003
• [docs] Update glossary - daily scan by @github-actions[bot] in #49117
• [docs] Update documentation for features from 2026-07-30 by @github-actions[bot] in #49120
• fix: use grep -E + sed instead of grep -P in sync-compat.sh for macOS compatibility by @pelikhan with @Copilot in #49127
• test: regression tests for validation/push file-set parity in create_pull_request by @pelikhan with @Copilot in #49075
• feat: support local skill paths in frontmatter skills: with --from-local by @pelikhan with @Copilot in #49115
• [WIP] Fix failing GitHub Actions job Unit tests (A-C) by @pelikhan with @Copilot in #49132
• Harden scanner/relaunch exec paths against command and argument injection by @pelikhan with @Copilot in #49063
• [actions] Update GitHub Actions versions - 2026-07-30 by @github-actions[bot] in #49097
• fix: emit interpolation step when prompt contains runtime-import macros by @pelikhan with @Copilot in #49122
• feat(pi): add bare mode support by @pelikhan with @Copilot in #49137
• fix: clear all git config scopes before overriding extraheader to prevent duplicate Authorization headers by @pelikhan with @Copilot in #49059
• feat: support bounded queries in workflow frontmatter and AWF configuration by @lpcox with @Copilot in #49149
• Bump firewall to v0.27.43 and mcpg to v0.4.7 by @lpcox with @Copilot in #49150
• Improve compile output clarity and color by @pelikhan in #49139
• fix: enforce three-level version priority for Copilot CLI install by @pelikhan with @Copilot in #49116
• [log] Add debug logging to five pkg/linters analyzers by @github-actions[bot] in #49260
• [docs] docs: trim redundant prose in MCP guide by @github-actions[bot] in #49239
• Normalize non-release GH_AW_COMPILED_VERSION to dev by @pelikhan with @Copilot in #49264
• [community] Update community contributions in README by @github-actions[bot] in #49249
• [docs] docs: fix non-standard word in quick-start guide by @github-actions[bot] in #49259
• fix(ambient-context): reduce prompt bloat in ai-moderator, pr-sous-chef, daily-cache-strategy-analyzer by @pelikhan with @Copilot in #49225
• fix(doc-automation): exclude experimental engines from engines.md consistency check by @pelikhan with @Copilot in #49228
• [code-simplifier] refactor: dedupe isRestEndpoint helper into github_api_helpers.cjs by @github-actions[bot] in #49261
• Add t.Parallel() to leaf utility package tests (stringutil, fileutil, timeutil, constants) by @pelikhan with @Copilot in #49229
• fix: findWorkflowFile checks .yaml extension in addition to .yml by @pelikhan with @Copilot in #49230
• Harden Docker scanner and upgrade re-exec argument validation by @pelikhan with @Copilot in #49278
• feat: per-output github-app override in safe-outputs by @pelikhan with @Copilot in #49226
• chore: bump github-mcp-server to v1.8.0, fields parameter now default by @pelikhan with @Copilot in #49274
• [rendering-scripts] fix: normalize pi engine bash tool name for correct log rendering by @github-actions[bot] in #49304
• [spec-extractor] Update package specifications for envutil, fileutil, gitutil, logger by @github-actions[bot] in #49312
• fix(gh-aw-node): patch bundled tar/brace-expansion CVEs, bump npm to 11.19.0 by @pelikhan with @Copilot in #49314
• Clarify why charmbracelet/x/term is imported in pkg/styles/theme.go by @pelikhan with @Copilot in #49322
• [docs] Update documentation for features from 2026-07-31 by @github-actions[bot] in #49320
• fix(agentrx-optimizer): add logs precondition rules and retry cap by @pelikhan with @Copilot in #49315
• [docs] Update glossary - daily scan by @github-actions[bot] in #49318
• [eslint-miner] eslint-factory: add require-fetch-timeout rule by @github-actions[bot] in #49310
• fix: restore schema-aware probe detection for zero-arg safeoutputs tools by @pelikhan with @Copilot in #49313
• Keep cross-repo compile clones out of agent artifacts by @pelikhan with @Copilot in #49321
• Fix TYPE-008 conformance checker permission expectations by @pelikhan with @Copilot in #49324
• Fix evals judge parser dropping YES/NO answers as UNKNOWN for Claude engine output by @pelikhan with @Copilot in #49323
• Fix gh aw logs discarding all processed runs due to variable shadowing by @pelikhan with @Copilot in #49332

Full Changelog: v0.84.0...v0.84.1