v0.84.4

🌟 Release Highlights

This release focuses on security hardening, MCP tooling improvements, and a wide range of internal reliability and CI fixes.

🔒 Security Fixes

• Fixed an SSRF host-allowlist bypass in workflowspec imports and added secret redaction to mcp inspect output (#50259)
• Remediated critical CVEs in the serena-mcp-server container image (#50245)
• Fixed vulnerabilities in the node:lts-alpine base container image (#50207)
• Fixed a potential secret exfiltration issue in the docs-noob-tester lock file (#50296)
• Injected zizmor unverified-creator annotations for 9 SHA-pinned third-party actions to improve supply-chain auditability (#50015)

✨ What's New

• Added prompt discovery support to mcp-inspect, making it easier to explore MCP server capabilities (#49968)
• push_to_pull_request_branch/reporting workflows now report failed non-builtin jobs as issues automatically from the conclusion job (#49959)
• Replaced ASCII charts with matplotlib and clarified P10/P50/P90 terminology in the daily spending forecast workflow (#49978)

🐛 Bug Fixes & Improvements

• Fixed dynamic dispatch_workflow ref forwarding and prevented ref leakage into inputs (#50042)
• Fixed failure_kind misclassification for safe_outputs post-agent failures (#50037)
• Handled deleted PR head refs non-fatally to avoid unnecessary run failures (#50051)
• Fixed workflow update source-only merges (#50156)
• Fixed check_permissions to handle a missing inherited_role field (#50183)
• Enforced runner→gateway OIDC path to prevent AWF agent exposure for HTTP MCP auth (#50054)

📚 Documentation

• Documented PR ruleset patterns for enforcing agentic workflows (#49975)
• Removed Agent Finder mentions from skills docs and reinforced local skill discovery guidance (#50278, #50244)
• Fixed CLI/docs consistency: documented --shellcheck and --version, normalized update flag help (#50280)

🔧 Internal

Numerous internal refactors, test parallelization, linter additions, and CI reliability improvements across the compiler, safe-outputs pipeline, and agentic maintenance workflows.

Generated by 🚀 Release · auto · 22.7 AIC · ⊞ 11.3K

---

What's Changed

• [WIP] Fix failing GitHub Actions job 'agent' by @pelikhan with @Copilot in #49898
• [code-scanning-fix] Fix js/http-to-file-access: correct suppression comment placement by @github-actions[bot] in #49932
• [test-parallel] test: parallelize TestHelpExamplesAreValid by @github-actions[bot] in #49922
• fix: use net diff size (additions − deletions) for push memory patch size enforcement by @pelikhan with @Copilot in #49894
• [instructions] Sync instruction files with release v0.84.3 by @github-actions[bot] in #49941
• fix(eslint): resolve identifier-bound route arguments in no-github-request-interpolated-route by @pelikhan with @Copilot in #49926
• uncheckedflushreturn: flag discarded errors in defer ...Flush() by @pelikhan with @Copilot in #49908
• [docs] Update documentation for features from 2026-08-03 by @github-actions[bot] in #49958
• Document PR ruleset patterns for enforcing agentic workflows by @pelikhan with @Copilot in #49975
• docs: update architecture diagram scratchpad to 2026-08-03 full rebuild by @pelikhan with @Copilot in #49963
• [evals] Count failed push_evals_state runs as evals job failures in Daily Evals report by @pelikhan with @Copilot in #49967
• fix(arxiv-researcher): optimize token usage and raise max-ai-credits by @pelikhan with @Copilot in #49965
• fix: migrate all 10 filepath.Walk err-shadow sites (ADR-49633) and enforce in CI by @pelikhan with @Copilot in #49907
• Batch Daily Go Test Parallelizer to process up to 5 files per run by @pelikhan with @Copilot in #49960
• feat(daily-spending-forecast): replace ASCII charts with matplotlib and clarify P10/P50/P90 terminology by @pelikhan with @Copilot in #49978
• Issue Arborist: trim issue-fetch context to cut single-run token spikes by @pelikhan with @Copilot in #49974
• [aw] Prevent Layout Specification Maintainer early termination from tool-denial guardrail by @pelikhan with @Copilot in #49966
• Add unit tests for compiler_yaml_prompt.go prompt-chunking logic by @pelikhan with @Copilot in #49972
• feat: report failed non-builtin jobs as issues from conclusion job by @pelikhan with @Copilot in #49959
• feat(eslint-factory): add require-nan-check-after-env-numeric-parse rule by @pelikhan with @Copilot in #49962
• Increase Metrics Collector repo-memory patch cap to prevent push_repo_memory gate failures by @pelikhan with @Copilot in #49970
• Add prompt discovery to mcp-inspect by @pelikhan with @Copilot in #49968
• Bound DataFlow dataset setup and update the workflow to the current DataFlow API by @pelikhan with @Copilot in #49969
• Handle required-workflow daily AIC guardrail lookups and expose structural failure state by @pelikhan with @Copilot in #49961
• refactor: extract helpers from buildHandlerManagerStep in compiler_safe_outputs_steps.go by @pelikhan with @Copilot in #49971
• Tighten CLI help/docs consistency for global options, forecast, and repo flag semantics by @pelikhan with @Copilot in #50016
• [formal-spec] Add formal coverage for replace-label transitions and post-setLabels verification by @pelikhan with @Copilot in #50035
• DeepReport: treat risky posture-drop runs as infra failures unless write actuation is evidenced by @pelikhan with @Copilot in #50036
• Add fixture-count consistency checks for compliance fixture READMEs by @pelikhan with @Copilot in #50040
• Refactor cgo jobs to use cached checkout by @pelikhan with @Copilot in #50045
• Harden exec.Command inputs for scanner Docker invocations and upgrade re-exec by @pelikhan with @Copilot in #49996
• Fix accuracy gaps in create.md bootstrap prompt for external agents by @pelikhan with @Copilot in #50049
• Grant LintMonster update_issue permission for scheduled (non-issue-triggered) runs by @pelikhan with @Copilot in #50050
• [safe-output-integrator] Add safe-output coverage: data and report-failed-jobs by @github-actions[bot] in #50076
• Deduplicate oversized Code Scanning Fixer patches by @pelikhan with @Copilot in #50059
• Guard default AI credits pricing for unsupported AWF pins by @pelikhan with @Copilot in #50041
• Improve temp folder prompt test coverage by @pelikhan with @Copilot in #50070
• Fetch Copilot session event logs for optimization audits by @pelikhan with @Copilot in #50071
• Bump postcss from 8.5.15 to 8.5.25 in /eslint-factory in the npm_and_yarn group across 1 directory by @dependabot[bot] in #50081
• Emit authoritative Copilot custom-routing signal in lock metadata by @salmanmkc with @Copilot in #49991
• Fix dynamic dispatch_workflow ref forwarding and prevent ref leakage into inputs by @pelikhan with @Copilot in #50042
• Bump the npm_and_yarn group across 1 directory with 2 updates by @dependabot[bot] in #50082
• Handle deleted PR head refs non-fatally by @pelikhan with @Copilot in #50051
• fix(security): inject zizmor unverified-creator annotations for all 9 SHA-pinned third-party actions by @pelikhan with @Copilot in #50015
• Add squad-game-planner daily agentic workflow by @pelikhan with @Copilot in #50055
• [WIP] Fix failing GitHub Actions job 'Integration: CMD Tests' by @pelikhan with @Copilot in #50094
• Split logs_download.go into focused files (flatten, zip, artifacts) by @pelikhan with @Copilot in #50052
• Fix failure_kind misclassification for safe_outputs post-agent failures by @pelikhan with @Copilot in #50037
• Retry transient git-fetch failures during evals-state branch checkout by @pelikhan with @Copilot in #50058
• Render pre-agent workspace audit as a step summary table by @pelikhan with @Copilot in #50103
• Enforce runner→gateway OIDC path and prevent AWF agent exposure for HTTP MCP auth by @lpcox with @Copilot in #50054
• Add ctxutil.OrBackground helper to consolidate nil-context fallback duplication by @pelikhan with @Copilot in #50093
• [WIP] Block automatic retry for retry-blocked Copilot PR topics by @pelikhan with @Copilot in #50089
• [WIP] Optimize daily ambient context processing workflows by @pelikhan with @Copilot in #50091
• Update top-level SKILL loader instructions by @pelikhan with @Copilot in #50109
• Deduplicate GitHub Script step scaffold in safe_outputs_steps.go by @pelikhan with @Copilot in #50105
• Batch-backfill assignees for unassigned open issues by @pelikhan with @Copilot in #50110
• [WIP] Fix Sentry MCP sum() on string field issue by @pelikhan with @Copilot in #50083
• Configuring frontmatter for bundled artifact folders by @pelikhan with @Copilot in #50108
• Analyzing agentic_maintenance.yml generation issues by @pelikhan with @Copilot in #50107
• Render pre-agent audit summary as an ASCII tree by @pelikhan with @Copilot in #50125
• Move Token Usage header into step summary details by @pelikhan with @Copilot in #50126
• Improve pre-agent audit summary tree by @pelikhan with @Copilot in #50129
• [docs] docs: unbloat repository maintenance example by @github-actions[bot] in #50130
• Add AWF token steering frontmatter opt-out by @pelikhan with @Copilot in #50122
• Revise SKILL.md for GitHub Agentic Workflows by @pelikhan in #50144
• Refactoring squad steps for activation by @pelikhan with @Copilot in #50127
• Reduce shellcheck compile verbosity by @pelikhan in #50155
• Fix workflow update source-only merges by @pelikhan in #50156
• disable running shellcheck by default by @pelikhan in #50169
• move ambient-folders top by @pelikhan in #50168
• Refactoring opencode integration for shared workflows by @pelikhan with @Copilot in #50145
• Suppress ctxbackground lint in ctxutil.OrBackground by @pelikhan with @Copilot in #50171
• Sync designer.md with network shorthand corrections and skills/lsp/evals fields by @pelikhan with @Copilot in #50175
• Creating configuration files for agentic engine by @pelikhan with @Copilot in #50181
• Align "Download safe outputs items manifest" step name to Title Case by @pelikhan with @Copilot in #50176
• [WIP] Add enforcement for 4 type-resolved linters with zero production violations by @pelikhan with @Copilot in #50180
• [WIP] Fix vulnerabilities in node:lts-alpine container image by @pelikhan with @Copilot in #50207
• docs(eslint-factory): document 10 missing custom rules in README by @pelikhan with @Copilot in #50208
• [instructions] Sync instruction files with release v0.84.3 by @github-actions[bot] in #50221
• [docs] Update documentation for features from 2026-08-04 by @github-actions[bot] in #50235
• [docs] Update glossary - daily scan by @github-actions[bot] in #50234
• Bump @primer/octicons from 19.31.0 to 19.32.0 in /docs by @dependabot[bot] in #50231
• Bump @playwright/test from 1.62.0 to 1.62.1 in /docs by @dependabot[bot] in #50229
• Bump vite from 8.1.5 to 8.2.0 in /actions/setup/js by @dependabot[bot] in #50230
• [test-parallel] Add t.Parallel() to safe top-level Go tests (batch 1/25) by @github-actions[bot] in #50206
• Bump astro from 7.1.5 to 7.1.6 in /docs by @dependabot[bot] in #50227
• Bump @astrojs/starlight from 0.41.5 to 0.41.6 in /docs by @dependabot[bot] in #50228
• docs: never use Agent Finder for skill discovery by @pelikhan with @Copilot in #50244
• no-duplicate-constant-values: apply minimum-group-size guard to booleans by @pelikhan with @Copilot in #50247
• Update serena-mcp-server container image to remediate critical CVEs by @pelikhan with @Copilot in #50245
• Update AGENTS plan execution guidance by @pelikhan with @Copilot in #50270
• Document boolean duplicate-constant threshold by @pelikhan with @Copilot in #50261
• Document package spec audit gaps by @pelikhan with @Copilot in #50276
• Remove agentfinder mentions from skills.md by @pelikhan with @Copilot in #50278
• [WIP] Fix goose agentic engine configuration by @pelikhan with @Copilot in #50186
• Fix CLI/docs consistency: document --shellcheck and --version, normalize update flag help by @pelikhan with @Copilot in #50280
• Pin poutine Docker image to the digest-pinned constant by @pelikhan with @Copilot in #50279
• Modifying daily squad game planner to include file checks by @pelikhan with @Copilot in #50284
• [WIP] Fix check_permissions to handle missing inherited_role field by @pelikhan with @Copilot in #50183
• Implementing squad-plan slash command functionality by @pelikhan with @Copilot in #50294
• [WIP] Optimize Avenger workflow to fix model mismatch driving high AIC by @pelikhan with @Copilot in #50323
• Reduce GitHub MCP file-content token bloat by @pelikhan with @Copilot in #50324
• Updating squad plan agentic workflow for sub issues by @pelikhan with @Copilot in #50330
• Fix SSRF host-allowlist bypass in workflowspec imports and redact secrets in mcp inspect output by @pelikhan with @Copilot in #50259
• Analyzing Actions logs to fix agent job failure by @pelikhan with @Copilot in #50313
• [WIP] Fix secret exfiltration issue in docs-noob-tester.lock.yml by @pelikhan with @Copilot in #50296
• [WIP] Add support for OTLP export auth via Workload Identity Federation by @pelikhan with @Copilot in #50184
• Configuring agentic workflows with Aider documentation by @pelikhan with @Copilot in #50293
• Fix misplaced "Deny all network access" comment in poem-bot.md example by @pelikhan with @Copilot in #50343
• Wire up perPage-respecting list_workflows wrapper into deep-report and structural-analysis workflows by @pelikhan with @Copilot in #50342
• Updating squad.md for lazy setup configuration by @pelikhan with @Copilot in #50344

Full Changelog: v0.84.3...v0.84.4