🌟 Release Highlights
This release focuses on hardening the WASM guard subsystem, improving code quality through targeted refactoring, and expanding test coverage for the Rust guard and collaborator permission packages.
✨ What's New
-
WASM guard robustness (#6290, #6296): The wazero-based guard runtime now handles oversized
call_backendresponses via a size-hint protocol, uses larger I/O buffers, improves cache reconfiguration locking, and adds fallback-path coverage — making guard execution more reliable under high-load and edge-case conditions. -
DIFC flags module (#6243): Guard policy override logic has been refactored into a dedicated DIFC flags module, improving maintainability and consistency of security policy enforcement.
🐛 Bug Fixes & Improvements
- Config map expansion (#6289): Stdin config map expansion no longer duplicates environment/header logic, reducing the risk of subtle configuration drift.
- Flag/env override helper (#6288): A shared
applyFlagOrEnvhelper eliminates duplicated flag-override patterns across CLI commands.
🔬 Testing & Reliability
- Expanded Rust guard test coverage for GraphQL node paths and GitHub URL repo extraction (#6284, #6291).
- Improved unit tests for the MCP collaborator permission package (#6249).
- Added debug logging to
proxy/graphql_rewrite.gofor easier diagnostics (#6248).
🐳 Docker Image
docker pull ghcr.io/github/gh-aw-mcpg:v0.3.18
# or
docker pull ghcr.io/github/gh-aw-mcpg:latestSupported platforms: linux/amd64, linux/arm64
What's Changed
- Refactor guard policy override helper into DIFC flags module by @Copilot in #6243
- [test-improver] Improve tests for mcp collaborator permission package by @github-actions[bot] in #6249
- [log] Add debug logging to proxy/graphql_rewrite.go by @github-actions[bot] in #6248
- [Repo Assist] test(rust-guard): add GraphQL path and URL-parsing tests for helpers.rs by @github-actions[bot] in #6284
- refactor: extract applyFlagOrEnv helper to eliminate duplicate flag-override logic by @Copilot in #6288
- Harden wazero guard I/O defaults, cache reconfiguration locking, and fallback-path coverage by @Copilot in #6290
- Refactor stdin config map expansion to remove duplicated env/header logic by @Copilot in #6289
- Add rust-guard helper test coverage for GraphQL node paths and GitHub URL repo extraction by @Copilot in #6291
- fix(go-fan): remove edit tool, embed module summary in issue body by @Copilot in #6292
- Handle oversized WASM
call_backendresponses via size-hint protocol + larger guard buffers by @Copilot in #6296
Full Changelog: v0.3.17...v0.3.18