v0.88.0

🌟 Release Highlights

This release focuses on hardening the sandbox runtime, simplifying browser automation with a new Playwright CLI approach, and fixing dependency resolution for nested workflow imports.

⚠️ Breaking Changes

• Removed built-in Playwright MCP support (#57521). Browser automation now goes through the new Playwright CLI guidance instead of the bundled MCP server — update workflows that relied on the built-in Playwright MCP tool.

✨ What's New

• Sandbox security settings replaced with runtime profiles (#57692) — legacy sandbox security flags are now expressed as declarative runtime profiles, making sandbox configuration easier to reason about. See the sandbox reference.
• Playwright CLI guidance and browser provisioning (#57731, #57691, #57594) — new AWF-aware policy prompts, configuration, and a shared smoke test make it easier to provision and use Playwright safely from agentic workflows.
• gh-aw-firewall v0.28.12 integration (#57514) — pulls in attested Cloud Hypervisor artifacts for stronger supply-chain guarantees on the firewall image.
• Operational value report evaluator and history (#57503) — new tooling to evaluate and track the operational value of agentic workflow runs over time.

🐛 Bug Fixes & Improvements

• Fixed dependency ordering and cycle detection for nested imports (#57746) — resolves incorrect ordering and undetected cycles when shared workflow files import each other transitively. See the imports reference.
• Codex custom tools now classified as invalid-model failures (#57578) — clearer error reporting when Codex is configured with unsupported custom tools.
• Fixed stale skill docs and repo-path guard (#57579) for the action-based JS architecture.
• Super-Linter restricted to Go modules (#57465), reducing noise from linting unrelated file types.
• Added a daily Windows Defender release scan (#57768) to catch malware false positives early.

Generated by 🚀 Release · copilot · auto · 20.7 AIC · ⊞ 11.8K

---

What's Changed

• [blog] Weekly blog post – 2026-08-31 by @github-actions[bot] in #57327
• [compiler-threat-spec] Daily threat spec optimizer: confirm CTR-004 coverage for duplicate Playwright --no-sandbox emission by @github-actions[bot] in #57321
• [code-simplifier] Simplify query-discussions.py: extract shared subprocess error handling by @github-actions[bot] in #57333
• [community] Update community contributions in README by @github-actions[bot] in #57320
• [log] Add debug logging to add_package_ownership.go by @github-actions[bot] in #57334
• chore: update drain3 default log pattern weights by @github-actions[bot] in #57346
• Restrict Super-Linter to Go modules by @pelikhan with @Copilot in #57465
• [spec-extractor] docs: correct stale source-file count in workflow package README by @github-actions[bot] in #57406
• [docs] Update glossary - weekly full scan by @github-actions[bot] in #57413
• [blog] Agent of the Day – 2026-08-31 by @github-actions[bot] in #57457
• [caveman] Optimize instruction verbosity — memory-stateful-patterns.md (2026-08-31) by @github-actions[bot] in #57509
• Remove built-in Playwright MCP support by @pelikhan with @Copilot in #57521
• Fix stale skill docs and repo-path guard for the action-based JS architecture by @pelikhan with @Copilot in #57579
• Classify unsupported Codex custom tools as invalid-model failures by @pelikhan with @Copilot in #57578
• Add AWF-aware Playwright CLI policy prompt by @lpcox with @Copilot in #57594
• [evoskill] Refine resolve-merge-conflicts skill: detect leftover conflict markers by @github-actions[bot] in #57601
• [docs] Update glossary - daily scan by @github-actions[bot] in #57673
• [instructions] Sync instruction files with release v0.87.10 by @github-actions[bot] in #57654
• [actions] Update GitHub Actions versions - 2026-09-01 by @github-actions[bot] in #57639
• [spec-extractor] Update package specifications for agentdrain, cli, console, constants by @github-actions[bot] in #57661
• Add operational value report evaluator and history functionality by @mnkiefer in #57503
• Replace legacy sandbox security settings with runtime profiles by @pelikhan with @Copilot in #57692
• Add Playwright configuration and usage guidance by @pelikhan with @Copilot in #57691
• Integrate gh-aw-firewall v0.28.12 attested Cloud Hypervisor artifacts by @lpcox with @Copilot in #57514
• [ci-coach] fix(cli): sync embedded fallback aw files list by @github-actions[bot] in #57710
• [blog] Agent of the Day – 2026-09-01 by @github-actions[bot] in #57715
• Add shared Playwright title smoke test by @pelikhan with @Copilot in #57721
• [safe-output-integrator] Add missing test-copilot-steer.md fixture for steer safe output by @github-actions[bot] in #57763
• Improve Playwright CLI guidance and browser provisioning by @lpcox with @Copilot in #57731
• Add daily Windows Defender release scan by @pelikhan with @Copilot in #57768
• Fix dependency ordering and cycle detection for nested imports by @pelikhan with @Copilot in #57746
• [caveman] Optimize instruction verbosity — network.md (2026-09-01) by @github-actions[bot] in #57777

Full Changelog: v0.87.10...v0.88.0