github/gh-aw v0.86.2 on GitHub

🌟 Release Highlights

This release focuses on hardening the sandbox and MCP gateway, smoothing out safe-output and threat-detection reliability, and shipping a steady stream of security and quality fixes across the compiler and CLI.

✨ What's New

Docker sandbox (docker-sbx) rollout continues — the sandboxed execution environment now runs for a larger share of agentic workflows, with fixes for pre-flight step naming, gVisor false positives, and Docker Hub secret handling (#51264, #51294, #51341, #51439, #51949). See the sandbox reference.
Agent runtime tracking — sandbox.agent.runtime is now stored in aw_info.json, and gh aw logs/gh aw audit gained a --runtime filter for easier debugging across engines (#51465, #52076). See agent runtimes.
MCP gateway hardening — explicit mount policy allowlisting for the safeoutputs backend server, plus a bump to gh-aw-mcpg v0.4.9 and github-mcp-server v1.9.0 (#51870, #51828).
Skills frontmatter flexibility — non-SHA refs are now allowed in skills frontmatter and pinned automatically at compile time, and an explicit end-marker syntax was added for inline skills/sub-agents (#51455, #51446).
Threat detection improvements — inline threat detection for Code Scanning Fixer, rendered detection logs with group/mask macros, and gh-aw's own <system> prompt block is no longer flagged as prompt injection (#51277, #51255, #51818). See threat detection.

🐛 Bug Fixes & Improvements

Fixed silent failures in the Copilot session data fetcher and in gh aw mcp inspect pagination (#51195, #51193).
Fixed Claude harness retrying invalid-JSON body errors with --continue instead of starting a fresh run (#51793).
Fixed a CGO/CJS workflow cache key collision that caused widespread job failures (#51342).
Fixed recurring gh-aw-firewall digest-pin loss on default firewall version bumps (#51423).
Fixed Windows MCP server timeouts by propagating context through GitHub CLI subprocess calls (#51426).
Fixed retry handling and denials in the Contribution Check proxy (#51631).
Added support for HEAD-only bundles when pushing to pull request branches (#51833).
Fixed safe-output run summary classification so entries are always linked and correctly attributed (#51484, #51478).

📚 Documentation

Documented the --runtime flag for gh aw logs/gh aw audit, agent runtime selection/troubleshooting, and clarified Claude engine selection in automated bootstrap (#52076, #51427, #52099).
Improved overall documentation discoverability and trimmed troubleshooting guides (#52065, #51251).

🔧 Internal

A large batch of custom-linter hardening, dependency bumps, test-parallelization, and dependency vulnerability remediations (container image pinning, ip-address patch, deprecated MCP container replacements) round out this release — thanks to the automated maintenance workflows keeping the codebase clean and secure.> Generated by 🚀 Release · auto · 20.7 AIC · ⊞ 11.3K

What's Changed

Add GitHub CLI fallback guidance to Daily Team Evolution Insights workflow prompt by @pelikhan with @Copilot in #51192
Bump Claude Code, OpenAI Codex, and Pi CLI pinned versions by @pelikhan with @Copilot in #51194
Fix silent conversation-transcript fetch failures in Copilot session data fetcher by @pelikhan with @Copilot in #51195
fix(threat-detection): stop uploading detection.log for external gh-aw-detection path by @davidslater in #51233
Harden safe-output field validation by @pelikhan in #51133
[docs] Self-healing documentation fixes from issue analysis - 2026-08-07 by @github-actions[bot] in #51235
[docs] docs: unbloat troubleshooting common issues by @github-actions[bot] in #51251
feat: enable docker-sbx sandbox for ~50% of agentic workflows by @pelikhan with @Copilot in #51264
Refactor safe-outputs handler assembly by @pelikhan with @Copilot in #51229
Refactor engine secret validation wrappers by @pelikhan with @Copilot in #51216
Fix silent pagination truncation in gh aw mcp inspect, dedupe connect logic by @pelikhan with @Copilot in #51193
Revert sbx to 10% of agentic workflows, set gvisor to 10% by @pelikhan with @Copilot in #51294
feat(threat-detection): render detection.log in detection job with group/mask macros by @pelikhan with @Copilot in #51255
[log] Add debug logging to guard-policy, arc-dind, and validation helpers by @github-actions[bot] in #51298
Increase post-result watchdog default to 120s and add frontmatter timeout override by @pelikhan with @Copilot in #51292
Handle discarded filepath.Glob errors in CLI by @pelikhan with @Copilot in #51296
Detect typed map[string]bool set aliases in short declarations by @pelikhan with @Copilot in #51303
fix(pydantic): install the pydantic-ai CLI and match the real pai interface by @pelikhan with @Copilot in #51242
Suppress RGS-012 false positive on the gVisor install step by @pelikhan with @Copilot in #51322
Add mobile interaction regression test for the home page quick-start CTA by @pelikhan with @Copilot in #51323
Use inline threat detection for Code Scanning Fixer by @pelikhan with @Copilot in #51277
[test-parallel] Add t.Parallel() to safe top-level tests in cmd/gh-aw by @github-actions[bot] in #51331
Refactor engine import defaults parameters by @pelikhan with @Copilot in #51295
[purelock] Lock down parsePermissionsConfig, validateImportInputType, resolveRuntimeCooldown with pure-function test suites by @github-actions[bot] in #51374
Fix require-error-code-in-thrown-error false positives on Identifier message args by @pelikhan with @Copilot in #51324
Remove bounded-queries from instruction files by @pelikhan with @Copilot in #51339
Fix CGO/CJS workflow cache key collision causing widespread job failures by @pelikhan with @Copilot in #51342
[instructions] Sync instruction files with release v0.86.1 by @github-actions[bot] in #51351
[spec-extractor] Update package specifications for agentdrain, cli, console, constants by @github-actions[bot] in #51355
Document missing internal dependencies in parser, cli, and workflow specs by @pelikhan with @Copilot in #51380
Standardize USE-001 error codes in add_labels and dismiss_pull_request_review by @pelikhan with @Copilot in #51338
Suppress systemic runner-guard gVisor false positives and remove docker-sbx shellcheck noise at source by @pelikhan with @Copilot in #51341
Detect thrown custom Error subclasses in error-code lint rule by @pelikhan with @Copilot in #51343
Bump pinned Claude Code CLI to 2.1.226 and Pi CLI to 0.84.1 by @pelikhan with @Copilot in #51340
[eslint-miner] Add ESLint rule: require-invalid-date-check-before-compare by @github-actions[bot] in #51354
Fix Copilot path portability across runners by @lpcox in #51275
Audit helper-built thrown Error messages by @pelikhan with @Copilot in #51412
Add formal PR outcome evaluator coverage by @pelikhan with @Copilot in #51403
feat(sandbox): add runtime-install field to control sbx/gVisor install step generation by @pelikhan with @Copilot in #51413
Allow Smoke Copilot dispatches to main by @pelikhan with @Copilot in #51416
remove aw-harness spec and all references by @pelikhan with @Copilot in #51428
Import shared reporting guidance into workflows missing report formatting rules by @pelikhan with @Copilot in #51431
Fix recurring gh-aw-firewall digest-pin loss on DefaultFirewallVersion bumps by @pelikhan with @Copilot in #51423
Suppress unenforceable action-failure expiry markers when no maintenance workflow will exist to close them by @pelikhan with @Copilot in #51425
Document agent runtime selection and troubleshooting by @lpcox in #51427
Add Simplified Technical English (STE) output_format variant to daily experiments by @pelikhan with @Copilot in #51442
[WIP] Fix failing GitHub Actions job lint-go by @pelikhan with @Copilot in #51444
Improve test quality for pkg/console/confirm_test.go by @pelikhan with @Copilot in #51434
Soft-fail missing docker-sbx Docker Hub secrets by @pelikhan with @Copilot in #51439
fix: propagate context through GitHub CLI subprocess calls to fix Windows MCP server timeout by @pelikhan with @Copilot in #51426
Add Ponytail pull request reviewer workflow by @pelikhan with @Copilot in #51454
Restore setup action before evals post-hook by @pelikhan with @Copilot in #51453
Fix invalid SKILL.md frontmatter metadata by @pelikhan with @Copilot in #51457
Fix broken relative links in skill docs by @pelikhan with @Copilot in #51458
[aw] Correct Kiro model ID in Daily Spec Coverage workflow by @pelikhan with @Copilot in #51456
Remove all uses of the Rig skill from agentic workflows by @pelikhan with @Copilot in #51461
Allow non-SHA refs in skills frontmatter, pinned at compile time by @pelikhan with @Copilot in #51455
Make safe-output run summary entries regular and always linked by @dsyme with @Copilot in #51478
Regularize conclusion no-op summaries by @dsyme in #51487
Fix safe-output summary outcome classification by @dsyme with @Copilot in #51484
Raise Avenger turn budget for self-repair runs by @pelikhan with @Copilot in #51491
Store sandbox.agent.runtime in aw_info.json and add --runtime filter to logs/audit by @pelikhan with @Copilot in #51465
Add anti-probing guidance to submit_pull_request_review tool description by @pelikhan with @Copilot in #51469
[instructions] Sync instruction files with release v0.85.4 by @github-actions[bot] in #51553
[test-parallel] Add t.Parallel() to safe standalone Go tests (batch 1) by @github-actions[bot] in #51539
Add explicit end marker syntax for inline skills and sub-agents by @pelikhan with @Copilot in #51446
[docs] docs: trim repetition in editing workflows guide by @github-actions[bot] in #51486
[log] Add debug logging to under-instrumented wasm/console helpers by @github-actions[bot] in #51508
Deduplicate commit-ref SHA resolution in action_resolver by @pelikhan with @Copilot in #51472
fix(seenmapbool): treat non-true values in declaration-site composite literals as non-set maps by @pelikhan with @Copilot in #51514
[rendering-scripts] Fix Copilot engine bash tool name normalization in log rendering by @github-actions[bot] in #51551
Fix responsive docs navigation test targeting by @pelikhan with @Copilot in #51540
Unify skill reference parsing and classification by @pelikhan with @Copilot in #51473
Fix import cycle between pkg/logger and pkg/colorwriter by @pelikhan with @Copilot in #51562
Update Playwright CLI default version to 0.1.18 by @pelikhan with @Copilot in #51541
Apply the small-value-space guard to null-valued constants in no-duplicate-constant-values by @pelikhan with @Copilot in #51542
Require isNaN(getTime()) guard to precede and dominate the date comparison by @pelikhan with @Copilot in #51532
Remediate 14 collection/perf custom-lint findings by @pelikhan with @Copilot in #51507
Suppress poutine untrusted_checkout_exec via .poutine.yml skip rule by @pelikhan with @Copilot in #51533
[eslint-miner] eslint-factory: add require-spawn-error-listener rule by @github-actions[bot] in #51556
[avenger] Regenerate wasm golden files after poutine:ignore removal by @github-actions[bot] in #51569
Guard colorwriter against logger import cycles by @pelikhan with @Copilot in #51570
Refactor add interactive workflow run prompt by @pelikhan with @Copilot in #51517
Fix nolintlint format error in copilot_engine_execution.go by @pelikhan with @Copilot in #51579
Resolve spec-librarian export coverage drift in pkg READMEs by @pelikhan with @Copilot in #51592
[purelock] Lock down sameExpr, addAllowedToNetwork, rpcEntryToTimelineEvent with pure-function test suites by @github-actions[bot] in #51586
Fix flaky TestStatusWorkflows tests failing outside repo root by @pelikhan with @Copilot in #51582
Fix golint-custom failure: tolowerequalfold false positive on empty-string check by @pelikhan with @Copilot in #51602
Accept ADR-43244 and add predicate traceability by @pelikhan with @Copilot in #51611
Normalize report formatting guidance in 5 daily audit workflows by @pelikhan with @Copilot in #51612
test: formalize AWF config drift safeguards by @pelikhan with @Copilot in #51605
Grant agentic engines read/write access to /tmp/gh-aw in AWF sandbox by @pelikhan with @Copilot in #51608
Improve comment-memory config test coverage by @pelikhan with @Copilot in #51622
Skip stale review-thread node IDs in resolve_pull_request_review_thread instead of failing safe_outputs by @pelikhan with @Copilot in #51630
[blog] Weekly blog post – 2026-08-10 by @github-actions[bot] in #51671
Enforce four clean custom linters in CGO by @pelikhan with @Copilot in #51682
[spec-review] Update Safe Outputs conformance checker for recent spec changes by @github-actions[bot] in #51685
Fix Contribution Check proxy denials and retry handling by @pelikhan with @Copilot in #51631
[log] Add debug logging to threat-detection, frontmatter, and validation paths by @github-actions[bot] in #51676
Deduplicate update-entity parser wrappers in pkg/workflow by @pelikhan with @Copilot in #51647
Replace vulnerable ast-grep MCP container by @pelikhan with @Copilot in #51718
[specs] Update layout specification - 2026-08-10 by @github-actions[bot] in #51731
Use Alpine-based grafana/mcp-grafana image to clear container scan findings by @pelikhan with @Copilot in #51728
Require invalid-date guards to exit before comparisons by @pelikhan with @Copilot in #51720
[test-parallel] test: add t.Parallel() to safe pure-function tests in pkg/cli by @github-actions[bot] in #51706
Deduplicate safe-output body attribution handling by @pelikhan with @Copilot in #51648
[docs] Update glossary - weekly full scan by @github-actions[bot] in #51756
eslint-factory: detect relational comparisons of x.getTime() in require-invalid-date-check-before-compare by @pelikhan with @Copilot in #51729
Refactor action pin warnings and agentdrain helpers by @pelikhan with @Copilot in #51674
Patch vulnerable ip-address dependency in gh-aw-node by @pelikhan with @Copilot in #51719
Replace vulnerable mcp/context7 container with the hosted Context7 HTTP MCP server by @pelikhan with @Copilot in #51727
[eslint-miner] Add require-mkdtempsync-try-catch ESLint rule by @github-actions[bot] in #51746
[code-simplifier] Simplify add_reviewer.cjs: extract copilot reviewer helper by @github-actions[bot] in #51675
Harden runner-guard Docker command rendering by @pelikhan with @Copilot in #51753
Remove python:alpine container usage and pins to clear container scan findings by @pelikhan with @Copilot in #51762
Suppress SC2016 for literal behavior-defined engine configs by @pelikhan with @Copilot in #51759
Disable vulnerable arXiv MCP container by @pelikhan with @Copilot in #51758
Remove vulnerable open-ontologies container image from glossary-maintainer workflow by @pelikhan with @Copilot in #51778
Align MCP management tool annotation helpers by @pelikhan with @Copilot in #51785
Mitigate mcp/memory scan findings by removing container usage and pin references by @pelikhan with @Copilot in #51752
Normalize --help flag description for the help command by @pelikhan with @Copilot in #51829
Add coverage-aware perf gating for allocation-focused custom linters by @pelikhan with @Copilot in #51573
Bump MCP Gateway (gh-aw-mcpg) from v0.4.8 to v0.4.9 by @pelikhan with @Copilot in #51754
Bump gh-aw-mcpg to v0.4.9 and github-mcp-server to v1.9.0 by @pelikhan with @Copilot in #51828
Fix coverage profile environment lookup lint failure by @pelikhan with @Copilot in #51847
Formalize CTR-022/CTR-023 behavior with predicate-level unit coverage by @pelikhan with @Copilot in #51820
[purelock] Lock down removeUnsafeEngineEnvKeys, migrateMessagesEffectiveTokensSuffixToAICreditsSuffix with pure-function test suites by @github-actions[bot] in #51783
Restrict Gemini/Cursor/Kiro engines to smoke-* workflows by @pelikhan with @Copilot in #51869
Stop threat detection from flagging gh-aw's own <system> prompt block as prompt injection by @pelikhan with @Copilot in #51818
Use parameterized GraphQL variables instead of Sprintf interpolation by @pelikhan with @Copilot in #51827
Fix Claude harness retrying invalid-JSON body error with --continue instead of a fresh run by @pelikhan with @Copilot in #51793
Fix MCP gateway mount policy rejection for safeoutputs backend server by @pelikhan with @Copilot in #51870
Pretty-print audit workflow repo-memory JSON by @pelikhan with @Copilot in #51890
Enable threat detection for Q and ESLint Monster workflows by @pelikhan with @Copilot in #51891
Add native-counterpart doc comments to progress_wasm.go and spinner_wasm.go by @pelikhan with @Copilot in #51904
Fix Matt Pocock skills reviewer pin by @pelikhan with @Copilot in #51902
Support HEAD-only bundles when pushing to pull request branches by @pelikhan with @Copilot in #51833
Allow add-wizard to initialize empty repositories by @pelikhan with @Copilot in #51895
Retry upload-asset pushes after concurrent branch updates by @pelikhan with @Copilot in #51893
Skip ripgrep apt install when rg already exists by @pelikhan with @Copilot in #51915
Prevent raw observability log loss during artifact extraction by @pelikhan with @Copilot in #51907
DeepReport: align repo-memory paths with branch root and allow JSON state files by @pelikhan with @Copilot in #51931
Allow sandbox agents to reach declared service ports by @pelikhan with @Copilot in #51842
Render workflow prompts with JavaScript instead of shell heredocs by @pelikhan with @Copilot in #51850
Add missing push-repo-memory mapping to the workflow designer by @pelikhan with @Copilot in #51937
Enforce ctxbackground in cgo custom lint by @pelikhan with @Copilot in #51936
Add Kimi K3 to the Copilot model inventory by @pelikhan with @Copilot in #51938
Suppress visual regression loopback Runner-Guard finding by @pelikhan with @Copilot in #51947
Align docker-sbx pre-flight step naming by @pelikhan with @Copilot in #51949
Fix errorfwrapv false positive on explicit arg index before dynamic * width by @pelikhan with @Copilot in #51932
[instructions] Sync instruction files with release v0.86.1 by @github-actions[bot] in #51991
[spec-extractor] Update package specifications for agentdrain, cli, console, constants by @github-actions[bot] in #51998
[docs] Update glossary - daily scan by @github-actions[bot] in #52007
Bump @github/copilot-sdk from 1.0.8 to 1.0.9 in /actions/setup/js by @dependabot[bot] in #52005
Bump astro from 7.1.6 to 7.2.0 in /docs by @dependabot[bot] in #52004
Bump vite from 8.2.0 to 8.2.1 in /actions/setup/js by @dependabot[bot] in #52003
Bump @astrojs/starlight from 0.41.6 to 0.41.7 in /docs by @dependabot[bot] in #52001
Bump @primer/octicons from 19.32.0 to 19.33.0 in /docs by @dependabot[bot] in #52002
Bump @types/node from 26.1.1 to 26.2.0 in /actions/setup/js by @dependabot[bot] in #52000
Rename panic linter test fixture functions by @pelikhan with @Copilot in #52051
Bump Claude Code CLI to 2.1.227 and Copilot CLI to 1.0.79 by @pelikhan with @Copilot in #51977
Detect spawn DI fallback bindings in error-listener rule by @pelikhan with @Copilot in #51975
Refactor duplicated pkg/cli outcome and stats helpers by @pelikhan with @Copilot in #51948
Make spawn error listener checks path-sensitive by @pelikhan with @Copilot in #51982
[eslint-miner] eslint-factory: add no-json-stringify-set-or-map rule by @github-actions[bot] in #51995
Use cursor traversal in analyzer helper by @pelikhan with @Copilot in #52058
Remediate targeted custom-linter findings by @pelikhan with @Copilot in #51942
[aw] Reduce Daily PR review tool-denial failures in Copilot SDK runs by @pelikhan with @Copilot in #52060
Remediate dynamic regexp pattern findings by @pelikhan with @Copilot in #51941
Harden remote workflow import fallbacks to prevent cross-host downgrade to public GitHub by @pelikhan with @Copilot in #51976
Harden scanner/relaunch exec trust boundaries and argument validation by @pelikhan with @Copilot in #52032
docs: document --runtime flag for gh aw logs and gh aw audit by @pelikhan with @Copilot in #52076
Suppress benign workflow exfiltration findings by @pelikhan with @Copilot in #52083
Normalize report formatting in video-analyzer, plan, and centralization-drilldown workflows by @pelikhan with @Copilot in #52085
Improve GitHub Agentic Workflows documentation discoverability by @pelikhan with @Copilot in #52065
Fix inverted strict: mode documentation in frontmatter reference by @pelikhan with @Copilot in #52100
Clarify Claude engine selection in automated bootstrap by @pelikhan with @Copilot in #52099

Full Changelog: v0.86.1...v0.86.2