From 791e20c548b61a6355a6578efb29c1401c1b10fa Mon Sep 17 00:00:00 2001
From: Landon Cox <landon.cox@microsoft.com>
Date: Tue, 20 Oct 2026 14:45:45 -0700
Subject: [PATCH 1/6] fix: repair Docker enclave smoke workflow compatibility

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 89c6ca75-abc8-456b-847f-01055d487e63
---
 .../smoke-enclave-build-test.lock.yml         | 26 +++----
 .github/workflows/smoke-enclave-build-test.md |  2 +-
 .../smoke-enclave-issues-read.lock.yml        | 10 +--
 .../workflows/smoke-enclave-issues-read.md    | 10 ++-
 scripts/ci/apply-general-workflow-patches.ts  | 25 +++++++
 scripts/ci/smoke-enclave-workflow.test.ts     | 74 +++++++++++++++++++
 6 files changed, 126 insertions(+), 21 deletions(-)

diff --git a/.github/workflows/smoke-enclave-build-test.lock.yml b/.github/workflows/smoke-enclave-build-test.lock.yml
index a7e7e969c..9414f7519 100644
--- a/.github/workflows/smoke-enclave-build-test.lock.yml
+++ b/.github/workflows/smoke-enclave-build-test.lock.yml
@@ -1,4 +1,4 @@
-# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"af5332542c92c3fbfe98f11bd0f1da050e56e624df2f21a16986a016f893a73d","body_hash":"0a05b8ac48a9b5afa18351812875380887d4941d3461294bbda04c11c6ee3401","compiler_version":"v0.92.6","agent_id":"copilot","engine_versions":{"copilot":"1.0.34"}}
+# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"47317bbdcfbb378530177478766b0a980470167d57dd52bb0c69bc5c186669ef","body_hash":"0a05b8ac48a9b5afa18351812875380887d4941d3461294bbda04c11c6ee3401","compiler_version":"v0.92.6","agent_id":"copilot","engine_versions":{"copilot":"1.0.80"}}
 # gh-aw-manifest: {"version":1,"secrets":["GH_AW_DEFAULT_OTLP_ENDPOINT","GH_AW_DEFAULT_OTLP_HEADERS","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/checkout","sha":"3d3c42e5aac5ba805825da76410c181273ba90b1","version":"v7.0.1"},{"repo":"actions/download-artifact","sha":"9000827ccba6bdab643e8b6fd33ac0654aef8333","version":"v8.0.2"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/upload-artifact","sha":"cf430e030ddbb5b0abf93d22962f4752f3646cd9","version":"v7.0.2"},{"repo":"github/gh-aw-actions/setup","sha":"8b9c5e98dfe3472ac4e3f13e0a2441cd078a2ca7","version":"v0.92.6"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.28.1","digest":"sha256:5e3f6ee27eeae07195838b97ac4aa2f8aea42a7c55f1c0d3e17d8e88e294ad0d","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.28.1@sha256:5e3f6ee27eeae07195838b97ac4aa2f8aea42a7c55f1c0d3e17d8e88e294ad0d"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.28.1","digest":"sha256:288e7d2a12d5b430500d739f9c16e20bb1ed51b91f986f3f3eccde189f489f5c","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.28.1@sha256:288e7d2a12d5b430500d739f9c16e20bb1ed51b91f986f3f3eccde189f489f5c"},{"image":"ghcr.io/github/gh-aw-firewall/enclave-mcp-server:0.28.1","digest":"sha256:1cb97151e32ac08f9265b323e7990aaa69ffefee54b7ababcf44d9bdd03efb40","pinned_image":"ghcr.io/github/gh-aw-firewall/enclave-mcp-server:0.28.1@sha256:1cb97151e32ac08f9265b323e7990aaa69ffefee54b7ababcf44d9bdd03efb40"},{"image":"ghcr.io/github/gh-aw-firewall/enclave-script:0.28.1","digest":"sha256:daed9f725e293344d16657b0c10a99e91ba90dac1638bf20cd6b4a7e7dfcc8ae","pinned_image":"ghcr.io/github/gh-aw-firewall/enclave-script:0.28.1@sha256:daed9f725e293344d16657b0c10a99e91ba90dac1638bf20cd6b4a7e7dfcc8ae"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.28.1","digest":"sha256:9d428af47899bf18ef2d5618075777d76ef344c91e76c1f44ec1aaa0ee347e5f","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.28.1@sha256:9d428af47899bf18ef2d5618075777d76ef344c91e76c1f44ec1aaa0ee347e5f"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.4.35","digest":"sha256:35e28671836380c0eae52660ea2ad7e5f6659f63cb20d1abae9271656c670858","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.4.35@sha256:35e28671836380c0eae52660ea2ad7e5f6659f63cb20d1abae9271656c670858"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:11c2c544876cdbaffefe0f7f1283b74838c209654b4934a78e23ed11f750490f","pinned_image":"ghcr.io/github/gh-aw-node@sha256:11c2c544876cdbaffefe0f7f1283b74838c209654b4934a78e23ed11f750490f"},{"image":"ghcr.io/github/github-mcp-server:v2.0.2","digest":"sha256:ffced0d76e77428532a2ced185516992d77fd146d69eec2f244e6237d1a97796","pinned_image":"ghcr.io/github/github-mcp-server:v2.0.2@sha256:ffced0d76e77428532a2ced185516992d77fd146d69eec2f244e6237d1a97796"}],"mcp_servers":[{"name":"awf-enclave","tools":["*"]},{"name":"github","tools":["get_me"]},{"name":"safeoutputs","tools":["create_issue","missing_data","missing_tool","noop","report_incomplete"]}],"threat_detection":{"mode":"disabled"}}
 # This file was automatically generated by gh-aw (v0.92.6). DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md
 #
@@ -123,7 +123,7 @@ jobs:
         env:
           GH_AW_SETUP_WORKFLOW_NAME: "Smoke Enclave Build Test"
           GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/smoke-enclave-build-test.lock.yml@${{ github.ref }}
-          GH_AW_INFO_VERSION: "1.0.34"
+          GH_AW_INFO_VERSION: "1.0.80"
           GH_AW_INFO_AWF_VERSION: "v0.28.1"
           GH_AW_INFO_ENGINE_ID: "copilot"
           GH_AW_SETUP_AW_CONTEXT: ${{ inputs.aw_context }}
@@ -135,8 +135,8 @@ jobs:
           GH_AW_INFO_ENGINE_ID: "copilot"
           GH_AW_INFO_ENGINE_NAME: "GitHub Copilot CLI"
           GH_AW_INFO_MODEL: ${{ vars.GH_AW_MODEL_AGENT_COPILOT || vars.GH_AW_DEFAULT_MODEL_COPILOT || 'auto' }}
-          GH_AW_INFO_VERSION: "1.0.34"
-          GH_AW_INFO_AGENT_VERSION: "1.0.34"
+          GH_AW_INFO_VERSION: "1.0.80"
+          GH_AW_INFO_AGENT_VERSION: "1.0.80"
           GH_AW_INFO_CLI_VERSION: "v0.92.6"
           GH_AW_INFO_WORKFLOW_NAME: "Smoke Enclave Build Test"
           GH_AW_INFO_WORKFLOW_ID: ${{ job.workflow_ref }}
@@ -419,7 +419,7 @@ jobs:
       GH_AW_ASSETS_ALLOWED_EXTS: ""
       GH_AW_ASSETS_BRANCH: ""
       GH_AW_ASSETS_MAX_SIZE_KB: 0
-      GH_AW_ENGINE_VERSION: "1.0.34"
+      GH_AW_ENGINE_VERSION: "1.0.80"
       GH_AW_MCP_LOG_DIR: /tmp/gh-aw/mcp-logs/safeoutputs
       GH_AW_PR_HEAD_BASE_BRANCH: ""
       GH_AW_PR_HEAD_BASE_PR_NUMBER: ""
@@ -467,7 +467,7 @@ jobs:
         env:
           GH_AW_SETUP_WORKFLOW_NAME: "Smoke Enclave Build Test"
           GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/smoke-enclave-build-test.lock.yml@${{ github.ref }}
-          GH_AW_INFO_VERSION: "1.0.34"
+          GH_AW_INFO_VERSION: "1.0.80"
           GH_AW_INFO_AWF_VERSION: "v0.28.1"
           GH_AW_INFO_ENGINE_ID: "copilot"
           GH_AW_SETUP_AW_CONTEXT: ${{ inputs.aw_context }}
@@ -532,7 +532,7 @@ jobs:
             const { main } = require(path.join(actionsDir, 'checkout_pr_branch.cjs'));
             await main();
       - name: Install GitHub Copilot CLI
-        run: bash "${RUNNER_TEMP}/gh-aw/actions/install_copilot_cli.sh" 1.0.34
+        run: bash "${RUNNER_TEMP}/gh-aw/actions/install_copilot_cli.sh" 1.0.80
         env:
           GH_HOST: github.com
           GH_AW_COPILOT_MIN_VERSION: 1.0.35
@@ -1298,7 +1298,7 @@ jobs:
         env:
           GH_AW_SETUP_WORKFLOW_NAME: "Smoke Enclave Build Test"
           GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/smoke-enclave-build-test.lock.yml@${{ github.ref }}
-          GH_AW_INFO_VERSION: "1.0.34"
+          GH_AW_INFO_VERSION: "1.0.80"
           GH_AW_INFO_AWF_VERSION: "v0.28.1"
           GH_AW_INFO_ENGINE_ID: "copilot"
           GH_AW_SETUP_AW_CONTEXT: ${{ inputs.aw_context }}
@@ -1341,7 +1341,7 @@ jobs:
           GH_AW_WORKFLOW_NAME: "Smoke Enclave Build Test"
           GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}/.github/workflows/smoke-enclave-build-test.md"
           GH_AW_ENGINE_ID: "copilot"
-          GH_AW_ENGINE_VERSION: "1.0.34"
+          GH_AW_ENGINE_VERSION: "1.0.80"
           GH_AW_ENGINE_MODEL: ${{ needs.agent.outputs.model }}
           GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
           GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }}
@@ -1367,7 +1367,7 @@ jobs:
           GH_AW_WORKFLOW_NAME: "Smoke Enclave Build Test"
           GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}/.github/workflows/smoke-enclave-build-test.md"
           GH_AW_ENGINE_ID: "copilot"
-          GH_AW_ENGINE_VERSION: "1.0.34"
+          GH_AW_ENGINE_VERSION: "1.0.80"
           GH_AW_ENGINE_MODEL: ${{ needs.agent.outputs.model }}
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
@@ -1387,7 +1387,7 @@ jobs:
           GH_AW_WORKFLOW_NAME: "Smoke Enclave Build Test"
           GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}/.github/workflows/smoke-enclave-build-test.md"
           GH_AW_ENGINE_ID: "copilot"
-          GH_AW_ENGINE_VERSION: "1.0.34"
+          GH_AW_ENGINE_VERSION: "1.0.80"
           GH_AW_ENGINE_MODEL: ${{ needs.agent.outputs.model }}
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
@@ -1585,7 +1585,7 @@ jobs:
       GH_AW_CALLER_WORKFLOW_ID: "${{ github.repository }}/smoke-enclave-build-test"
       GH_AW_ENGINE_ID: "copilot"
       GH_AW_ENGINE_MODEL: ${{ needs.agent.outputs.model }}
-      GH_AW_ENGINE_VERSION: "1.0.34"
+      GH_AW_ENGINE_VERSION: "1.0.80"
       GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }}
       GH_AW_SAFE_OUTPUT_MESSAGES: "{\"footer\":\"\\u003e 🔐🏗️ *Enclave build test by [{workflow_name}]({run_url})*\",\"runStarted\":\"🔐🏗️ [{workflow_name}]({run_url}) is checking the gh-aw build surface through an enclave...\",\"runSuccess\":\"🔐🏗️ [{workflow_name}]({run_url}) completed. Enclave build test passed. ✅\",\"runFailure\":\"🔐🏗️ [{workflow_name}]({run_url}) reports {status}. Enclave build compatibility issue detected.\"}"
       GH_AW_WORKFLOW_ID: "smoke-enclave-build-test"
@@ -1619,7 +1619,7 @@ jobs:
         env:
           GH_AW_SETUP_WORKFLOW_NAME: "Smoke Enclave Build Test"
           GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/smoke-enclave-build-test.lock.yml@${{ github.ref }}
-          GH_AW_INFO_VERSION: "1.0.34"
+          GH_AW_INFO_VERSION: "1.0.80"
           GH_AW_INFO_AWF_VERSION: "v0.28.1"
           GH_AW_INFO_ENGINE_ID: "copilot"
           GH_AW_SETUP_AW_CONTEXT: ${{ inputs.aw_context }}
diff --git a/.github/workflows/smoke-enclave-build-test.md b/.github/workflows/smoke-enclave-build-test.md
index e05e7d655..135372b83 100644
--- a/.github/workflows/smoke-enclave-build-test.md
+++ b/.github/workflows/smoke-enclave-build-test.md
@@ -11,7 +11,7 @@ env:
 name: Smoke Enclave Build Test
 engine:
   id: copilot
-  version: 1.0.34
+  version: 1.0.80
   args: ["--allow-tool", "awf-enclave(enclave_run_script)"]
 network:
   allowed:
diff --git a/.github/workflows/smoke-enclave-issues-read.lock.yml b/.github/workflows/smoke-enclave-issues-read.lock.yml
index f2e360ce9..eef4a795a 100644
--- a/.github/workflows/smoke-enclave-issues-read.lock.yml
+++ b/.github/workflows/smoke-enclave-issues-read.lock.yml
@@ -1,5 +1,5 @@
-# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"7588cabdf16eace9c6387e150539b2e3add22111314fb9875a08d303d1580e4f","body_hash":"57f6b935058d34b553ce6181607b53ebffefb90ef654d9bb6f8dd0f9791ddad8","compiler_version":"v0.92.6","agent_id":"copilot","engine_versions":{"copilot":"1.0.80"}}
-# gh-aw-manifest: {"version":1,"secrets":["GH_AW_DEFAULT_OTLP_ENDPOINT","GH_AW_DEFAULT_OTLP_HEADERS","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/checkout","sha":"3d3c42e5aac5ba805825da76410c181273ba90b1","version":"v7.0.1"},{"repo":"actions/download-artifact","sha":"9000827ccba6bdab643e8b6fd33ac0654aef8333","version":"v8.0.2"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/upload-artifact","sha":"cf430e030ddbb5b0abf93d22962f4752f3646cd9","version":"v7.0.2"},{"repo":"github/gh-aw-actions/setup","sha":"8b9c5e98dfe3472ac4e3f13e0a2441cd078a2ca7","version":"v0.92.6"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.28.13","digest":"sha256:78aeb1eee876d1ebae5eef26402bd9f31112850d42016a240002d1da57203e15","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.28.13@sha256:78aeb1eee876d1ebae5eef26402bd9f31112850d42016a240002d1da57203e15"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.28.13","digest":"sha256:61f12dcff38eb008b645d87a5541763452f409d9040eb243718764944167b1a2","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.28.13@sha256:61f12dcff38eb008b645d87a5541763452f409d9040eb243718764944167b1a2"},{"image":"ghcr.io/github/gh-aw-firewall/enclave-agent:0.28.13","digest":"sha256:13db988aacd5dbd6e43815faaeb42af6bf6f8b4f824b5fa88fd4f4f329203441","pinned_image":"ghcr.io/github/gh-aw-firewall/enclave-agent:0.28.13@sha256:13db988aacd5dbd6e43815faaeb42af6bf6f8b4f824b5fa88fd4f4f329203441"},{"image":"ghcr.io/github/gh-aw-firewall/enclave-mcp-server:0.28.13","digest":"sha256:ed8b1b2fd160e6b32b69352f3df8b24dfb3b286e77695c95c11fa940617467b2","pinned_image":"ghcr.io/github/gh-aw-firewall/enclave-mcp-server:0.28.13@sha256:ed8b1b2fd160e6b32b69352f3df8b24dfb3b286e77695c95c11fa940617467b2"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.28.13","digest":"sha256:58a8dc5be3fbafeef7da0532c38bd9047f86bf1b3c4cfd7d9b7d8d28e80a2b56","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.28.13@sha256:58a8dc5be3fbafeef7da0532c38bd9047f86bf1b3c4cfd7d9b7d8d28e80a2b56"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.4.15","digest":"sha256:60cd97533e93d8e7be36b979c0f08a70846189bda6190f28bbd6d427bc0d9b6e","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.4.15@sha256:60cd97533e93d8e7be36b979c0f08a70846189bda6190f28bbd6d427bc0d9b6e"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:11c2c544876cdbaffefe0f7f1283b74838c209654b4934a78e23ed11f750490f","pinned_image":"ghcr.io/github/gh-aw-node@sha256:11c2c544876cdbaffefe0f7f1283b74838c209654b4934a78e23ed11f750490f"},{"image":"ghcr.io/github/github-mcp-server:v2.0.2","digest":"sha256:ffced0d76e77428532a2ced185516992d77fd146d69eec2f244e6237d1a97796","pinned_image":"ghcr.io/github/github-mcp-server:v2.0.2@sha256:ffced0d76e77428532a2ced185516992d77fd146d69eec2f244e6237d1a97796"}],"mcp_servers":[{"name":"awf-enclave","tools":["*"]},{"name":"github","tools":["get_commit","get_file_contents","get_latest_release","get_me","get_pull_request","get_pull_request_comments","get_pull_request_diff","get_pull_request_files","get_pull_request_review_comments","get_pull_request_reviews","get_pull_request_status","get_release_by_tag","get_tag","issue_read","list_branches","list_commits","list_issue_types","list_issues","list_pull_requests","list_releases","list_starred_repositories","list_tags","pull_request_read","search_code","search_issues","search_pull_requests","search_repositories"]},{"name":"safeoutputs","tools":["create_issue","missing_data","missing_tool","noop","report_incomplete"]}],"threat_detection":{"mode":"disabled"}}
+# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"7588cabdf16eace9c6387e150539b2e3add22111314fb9875a08d303d1580e4f","body_hash":"8b9b459f0dad3eef1a1b7f21b1351bad55e21d4e9fa49218976c7ce1081d460e","compiler_version":"v0.92.6","agent_id":"copilot","engine_versions":{"copilot":"1.0.80"}}
+# gh-aw-manifest: {"version":1,"secrets":["GH_AW_DEFAULT_OTLP_ENDPOINT","GH_AW_DEFAULT_OTLP_HEADERS","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/checkout","sha":"3d3c42e5aac5ba805825da76410c181273ba90b1","version":"v7.0.1"},{"repo":"actions/download-artifact","sha":"9000827ccba6bdab643e8b6fd33ac0654aef8333","version":"v8.0.2"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/upload-artifact","sha":"cf430e030ddbb5b0abf93d22962f4752f3646cd9","version":"v7.0.2"},{"repo":"github/gh-aw-actions/setup","sha":"8b9c5e98dfe3472ac4e3f13e0a2441cd078a2ca7","version":"v0.92.6"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.28.13","digest":"sha256:78aeb1eee876d1ebae5eef26402bd9f31112850d42016a240002d1da57203e15","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.28.13@sha256:78aeb1eee876d1ebae5eef26402bd9f31112850d42016a240002d1da57203e15"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.28.13","digest":"sha256:61f12dcff38eb008b645d87a5541763452f409d9040eb243718764944167b1a2","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.28.13@sha256:61f12dcff38eb008b645d87a5541763452f409d9040eb243718764944167b1a2"},{"image":"ghcr.io/github/gh-aw-firewall/enclave-agent:0.28.13","digest":"sha256:13db988aacd5dbd6e43815faaeb42af6bf6f8b4f824b5fa88fd4f4f329203441","pinned_image":"ghcr.io/github/gh-aw-firewall/enclave-agent:0.28.13@sha256:13db988aacd5dbd6e43815faaeb42af6bf6f8b4f824b5fa88fd4f4f329203441"},{"image":"ghcr.io/github/gh-aw-firewall/enclave-mcp-server:0.28.13","digest":"sha256:ed8b1b2fd160e6b32b69352f3df8b24dfb3b286e77695c95c11fa940617467b2","pinned_image":"ghcr.io/github/gh-aw-firewall/enclave-mcp-server:0.28.13@sha256:ed8b1b2fd160e6b32b69352f3df8b24dfb3b286e77695c95c11fa940617467b2"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.28.13","digest":"sha256:58a8dc5be3fbafeef7da0532c38bd9047f86bf1b3c4cfd7d9b7d8d28e80a2b56","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.28.13@sha256:58a8dc5be3fbafeef7da0532c38bd9047f86bf1b3c4cfd7d9b7d8d28e80a2b56"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.4.15","digest":"sha256:60cd97533e93d8e7be36b979c0f08a70846189bda6190f28bbd6d427bc0d9b6e","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.4.15@sha256:60cd97533e93d8e7be36b979c0f08a70846189bda6190f28bbd6d427bc0d9b6e"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:11c2c544876cdbaffefe0f7f1283b74838c209654b4934a78e23ed11f750490f","pinned_image":"ghcr.io/github/gh-aw-node@sha256:11c2c544876cdbaffefe0f7f1283b74838c209654b4934a78e23ed11f750490f"},{"image":"ghcr.io/github/github-mcp-server:v1.12.2","digest":"sha256:508a0857ec762b1ab1cece29193345b501fab1dd9d1228a7b617062954cecac6","pinned_image":"ghcr.io/github/github-mcp-server:v1.12.2@sha256:508a0857ec762b1ab1cece29193345b501fab1dd9d1228a7b617062954cecac6"}],"mcp_servers":[{"name":"awf-enclave","tools":["*"]},{"name":"github","tools":["get_commit","get_file_contents","get_latest_release","get_me","get_pull_request","get_pull_request_comments","get_pull_request_diff","get_pull_request_files","get_pull_request_review_comments","get_pull_request_reviews","get_pull_request_status","get_release_by_tag","get_tag","issue_read","list_branches","list_commits","list_issue_types","list_issues","list_pull_requests","list_releases","list_starred_repositories","list_tags","pull_request_read","search_code","search_issues","search_pull_requests","search_repositories"]},{"name":"safeoutputs","tools":["create_issue","missing_data","missing_tool","noop","report_incomplete"]}],"threat_detection":{"mode":"disabled"}}
 # This file was automatically generated by gh-aw (v0.92.6). DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md
 #
 #    ___                   _   _
@@ -47,7 +47,7 @@
 #   -
 #   - ghcr.io/github/gh-aw-mcpg:v0.4.15@sha256:60cd97533e93d8e7be36b979c0f08a70846189bda6190f28bbd6d427bc0d9b6e
 #   - ghcr.io/github/gh-aw-node@sha256:11c2c544876cdbaffefe0f7f1283b74838c209654b4934a78e23ed11f750490f
-#   - ghcr.io/github/github-mcp-server:v2.0.2@sha256:ffced0d76e77428532a2ced185516992d77fd146d69eec2f244e6237d1a97796
+#   - ghcr.io/github/github-mcp-server:v1.12.2@sha256:508a0857ec762b1ab1cece29193345b501fab1dd9d1228a7b617062954cecac6
 
 name: "Smoke Enclave Issues Read"
 on:
@@ -565,7 +565,7 @@ jobs:
           GH_AW_SKILL_DIR: ".github/skills"
         run: bash "${RUNNER_TEMP}/gh-aw/actions/restore_inline_skills.sh"
       - name: Download container images
-        run: bash "${RUNNER_TEMP}/gh-aw/actions/download_docker_images.sh" ghcr.io/github/gh-aw-mcpg:v0.4.15@sha256:60cd97533e93d8e7be36b979c0f08a70846189bda6190f28bbd6d427bc0d9b6e ghcr.io/github/gh-aw-node@sha256:11c2c544876cdbaffefe0f7f1283b74838c209654b4934a78e23ed11f750490f ghcr.io/github/github-mcp-server:v2.0.2@sha256:ffced0d76e77428532a2ced185516992d77fd146d69eec2f244e6237d1a97796
+        run: bash "${RUNNER_TEMP}/gh-aw/actions/download_docker_images.sh" ghcr.io/github/gh-aw-mcpg:v0.4.15@sha256:60cd97533e93d8e7be36b979c0f08a70846189bda6190f28bbd6d427bc0d9b6e ghcr.io/github/gh-aw-node@sha256:11c2c544876cdbaffefe0f7f1283b74838c209654b4934a78e23ed11f750490f ghcr.io/github/github-mcp-server:v1.12.2@sha256:508a0857ec762b1ab1cece29193345b501fab1dd9d1228a7b617062954cecac6
       - name: Prepare Safe Outputs Directories
         run: |
           mkdir -p "${RUNNER_TEMP}/gh-aw/safeoutputs"
@@ -802,7 +802,7 @@ jobs:
               "github": {
                 "required": false,
                 "type": "stdio",
-                "container": "ghcr.io/github/github-mcp-server:v2.0.2",
+                "container": "ghcr.io/github/github-mcp-server:v1.12.2@sha256:508a0857ec762b1ab1cece29193345b501fab1dd9d1228a7b617062954cecac6",
                 "env": {
                   "GITHUB_FEATURES": "fields_param",
                   "GITHUB_HOST": "${GITHUB_SERVER_URL}",
diff --git a/.github/workflows/smoke-enclave-issues-read.md b/.github/workflows/smoke-enclave-issues-read.md
index 8c2776764..0065d6d22 100644
--- a/.github/workflows/smoke-enclave-issues-read.md
+++ b/.github/workflows/smoke-enclave-issues-read.md
@@ -114,6 +114,11 @@ post-steps:
 
 # Smoke Test: Read-Only GitHub Issues from an Agent Enclave
 
+The postprocessor pins this smoke's GitHub MCP server to the last-green
+`v1.12.2` image: mcpg `v0.4.15` expects a flat issue object and comments array,
+not the `issue_read` envelopes introduced in GitHub MCP server v2. Keep
+`tools.github: false` and the enclave's `approved` integrity policy intact.
+
 The primary agent has no GitHub MCP tools, GitHub credentials, or external
 network access. Use `enclave_run_agent` exactly once for the assigned
 `github/gh-aw` repository. Do not attempt GitHub access, network requests, shell
@@ -143,9 +148,10 @@ Use only the `github` MCP server and call each tool exactly once:
 2. Read the first returned issue number. If no issue is returned, set
    `issue_number` to `0` and all booleans to `false`.
 3. `issue_read` with `owner: "github"`, `repo: "gh-aw"`, `method: "get"`, and
-   the discovered issue number.
+   `issue_number` set to the discovered issue number as a JSON number.
 4. `issue_read` with `owner: "github"`, `repo: "gh-aw"`,
-   `method: "get_comments"`, the discovered issue number, and `perPage: 1`.
+   `method: "get_comments"`, `issue_number` set to that same JSON number,
+   and `perPage: 1`.
 
 Return exactly one object matching the schema. Set `issue_number` to the number
 from the first entry in the `list_issues` response's `issues` array. Set a
diff --git a/scripts/ci/apply-general-workflow-patches.ts b/scripts/ci/apply-general-workflow-patches.ts
index f23551f77..a2190be78 100644
--- a/scripts/ci/apply-general-workflow-patches.ts
+++ b/scripts/ci/apply-general-workflow-patches.ts
@@ -94,6 +94,31 @@ export function applyGeneralWorkflowPatches(
 
   if (workflowPath.endsWith('smoke-enclave-issues-read.lock.yml')) {
     const original = content;
+    // v2 issue_read envelopes are incompatible with this smoke's v0.4.15 guard.
+    // Keep the last-green flat-response server without weakening approved integrity.
+    const githubImage = 'ghcr.io/github/github-mcp-server:v1.12.2';
+    const githubDigest = 'sha256:508a0857ec762b1ab1cece29193345b501fab1dd9d1228a7b617062954cecac6';
+    const pinnedGithubImage = `${githubImage}@${githubDigest}`;
+    content = content.replace(
+      /ghcr\.io\/github\/github-mcp-server:[\w.-]+(?:@sha256:[a-f0-9]{64})?/g,
+      pinnedGithubImage
+    );
+    content = content.replace(
+      /^(# gh-aw-manifest: )(.+)$/m,
+      (_match, prefix: string, json: string) => {
+        const manifest = JSON.parse(json) as {
+          containers?: Array<{ image: string; digest: string; pinned_image: string }>;
+        };
+        for (const container of manifest.containers ?? []) {
+          if (container.image === pinnedGithubImage) {
+            container.image = githubImage;
+            container.digest = githubDigest;
+            container.pinned_image = pinnedGithubImage;
+          }
+        }
+        return prefix + JSON.stringify(manifest);
+      }
+    );
     content = content
       .split('\n')
       .map(line =>
diff --git a/scripts/ci/smoke-enclave-workflow.test.ts b/scripts/ci/smoke-enclave-workflow.test.ts
index 467e9f4aa..5f80b4a91 100644
--- a/scripts/ci/smoke-enclave-workflow.test.ts
+++ b/scripts/ci/smoke-enclave-workflow.test.ts
@@ -3,6 +3,7 @@ import * as os from 'os';
 import * as path from 'path';
 import { execFileSync } from 'child_process';
 import * as yaml from 'js-yaml';
+import Ajv from 'ajv';
 import { applyGeneralWorkflowPatches } from './apply-general-workflow-patches';
 import { buildBranchEnclaveInstallSteps, buildLocalInstallSteps } from './workflow-step-builders';
 
@@ -896,6 +897,26 @@ describe('smoke enclave build workflow', () => {
   const source = fs.readFileSync(sourcePath, 'utf8');
   const lock = fs.readFileSync(lockPath, 'utf8');
 
+  it('installs the authored CLI version above the generated feature minimum', () => {
+    const frontmatter = yaml.load(source.split('---')[1]) as {
+      engine: { version: string };
+    };
+    const compiled = yaml.load(lock) as {
+      jobs: { agent: { steps: Array<{ name: string; run?: string; env?: Record<string, string> }> } };
+    };
+    const install = compiled.jobs.agent.steps.find(step =>
+      step.name === 'Install GitHub Copilot CLI');
+    const minimum = install?.env?.GH_AW_COPILOT_MIN_VERSION;
+    expect(minimum).toMatch(/^\d+\.\d+\.\d+$/);
+    expect('1.0.34'.localeCompare(minimum!, 'en', { numeric: true })).toBeLessThan(0);
+    expect(frontmatter.engine.version.localeCompare(minimum!, 'en', { numeric: true }))
+      .toBeGreaterThanOrEqual(0);
+    expect(install?.run).toBe(
+      `bash "\${RUNNER_TEMP}/gh-aw/actions/install_copilot_cli.sh" ${frontmatter.engine.version}`
+    );
+    expect(lock).toContain(`"engine_versions":{"copilot":"${frontmatter.engine.version}"}`);
+  });
+
   it('uses gh-aw as an internal pseudo-private script enclave', () => {
     expect(source).toContain('repo: github/gh-aw');
     expect(source).toContain('sensitivity: internal');
@@ -1075,6 +1096,59 @@ describe('smoke enclave issues workflow', () => {
     );
   });
 
+  it('pins the last-green flat-response GitHub server in runtime and manifest', () => {
+    const image = 'ghcr.io/github/github-mcp-server:v1.12.2';
+    const digest = 'sha256:508a0857ec762b1ab1cece29193345b501fab1dd9d1228a7b617062954cecac6';
+    const pinned = `${image}@${digest}`;
+    const manifest = JSON.parse(lock.match(/^# gh-aw-manifest: (.+)$/m)![1]) as {
+      containers: Array<{ image: string; digest: string; pinned_image: string }>;
+    };
+    expect(manifest.containers.filter(container =>
+      container.image.startsWith('ghcr.io/github/github-mcp-server:')))
+      .toEqual([{ image, digest, pinned_image: pinned }]);
+    expect(lock).toContain(`"container": "${pinned}"`);
+    const compiled = yaml.load(lock) as {
+      jobs: { agent: { steps: Array<{ name: string; run?: string }> } };
+    };
+    expect(compiled.jobs.agent.steps.find(step =>
+      step.name === 'Download container images')?.run).toContain(pinned);
+    expect(lock).not.toContain('ghcr.io/github/github-mcp-server:v2.');
+    expect(source).toContain('`issue_number` set to the discovered issue number as a JSON number');
+
+    const incompatibleImage = 'ghcr.io/github/github-mcp-server:v2.0.2';
+    const incompatibleDigest = `sha256:${'f'.repeat(64)}`;
+    const compilerOutput = lock.split(image).join(incompatibleImage)
+      .split(digest).join(incompatibleDigest);
+    const patched = applyGeneralWorkflowPatches(compilerOutput, issuesLockPath).content;
+    expect(patched).toBe(lock);
+    expect(applyGeneralWorkflowPatches(patched, issuesLockPath).content).toBe(patched);
+    expect(applyGeneralWorkflowPatches(compilerOutput, dynamicLockPath).content)
+      .toContain(`${incompatibleImage}@${incompatibleDigest}`);
+  });
+
+  it('rejects v2 envelopes even when the nested issue author is approved', () => {
+    // mcpg v0.4.15 labels the returned object itself, not a nested "issue".
+    const ajv = new Ajv();
+    const issue = ajv.compile({
+      type: 'object',
+      required: ['number', 'author_association'],
+      properties: {
+        number: { type: 'integer' },
+        author_association: { type: 'string' },
+      },
+    });
+    const comments = ajv.compile({ type: 'array', items: { type: 'object' } });
+    const approvedIssue = { number: 42, author_association: 'MEMBER' };
+    const approvedComments = [{ id: 1, author_association: 'MEMBER' }];
+
+    expect(issue(approvedIssue)).toBe(true);
+    expect(comments(approvedComments)).toBe(true);
+    expect(comments([])).toBe(true);
+    expect(issue({ method: 'get', issue: approvedIssue })).toBe(false);
+    expect(comments({ method: 'get_comments', comments: approvedComments })).toBe(false);
+    expect(comments({ method: 'get_comments', comments: [] })).toBe(false);
+  });
+
   it('bounds the single enclave disclosure', () => {
     expect(source).toContain('max-invocations: 1');
     expect(source).toContain('max-output-bytes: 1024');

From b6fe3b568c89c4963a11bef1c8a52d149b368ebf Mon Sep 17 00:00:00 2001
From: Landon Cox <landon.cox@microsoft.com>
Date: Tue, 20 Oct 2026 15:31:08 -0700
Subject: [PATCH 2/6] fix: support digest-pinned enclave MCP images

Upgrade the static Issues smoke gateway to v0.4.36 so its schema accepts the immutable GitHub MCP server reference. Keep manifest, download, runtime, and cache pins aligned and cover old/new schema behavior without weakening approved integrity.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 89c6ca75-abc8-456b-847f-01055d487e63
---
 .github/aw/actions-lock.json                  | 10 ++++
 .../smoke-enclave-issues-read.lock.yml        | 12 ++---
 .../workflows/smoke-enclave-issues-read.md    |  8 +--
 scripts/ci/apply-general-workflow-patches.ts  |  2 +-
 scripts/ci/smoke-enclave-workflow.test.ts     | 53 +++++++++++++++++--
 5 files changed, 72 insertions(+), 13 deletions(-)

diff --git a/.github/aw/actions-lock.json b/.github/aw/actions-lock.json
index 2baa00af8..c7e8bc020 100644
--- a/.github/aw/actions-lock.json
+++ b/.github/aw/actions-lock.json
@@ -952,11 +952,21 @@
       "digest": "sha256:35e28671836380c0eae52660ea2ad7e5f6659f63cb20d1abae9271656c670858",
       "pinned_image": "ghcr.io/github/gh-aw-mcpg:v0.4.35@sha256:35e28671836380c0eae52660ea2ad7e5f6659f63cb20d1abae9271656c670858"
     },
+    "ghcr.io/github/gh-aw-mcpg:v0.4.36": {
+      "image": "ghcr.io/github/gh-aw-mcpg:v0.4.36",
+      "digest": "sha256:b4d2856018959c798b3e3f81ae4ab5b275e06354e123e1f7971de931f2f450f2",
+      "pinned_image": "ghcr.io/github/gh-aw-mcpg:v0.4.36@sha256:b4d2856018959c798b3e3f81ae4ab5b275e06354e123e1f7971de931f2f450f2"
+    },
     "ghcr.io/github/gh-aw-node": {
       "image": "ghcr.io/github/gh-aw-node",
       "digest": "sha256:11c2c544876cdbaffefe0f7f1283b74838c209654b4934a78e23ed11f750490f",
       "pinned_image": "ghcr.io/github/gh-aw-node@sha256:11c2c544876cdbaffefe0f7f1283b74838c209654b4934a78e23ed11f750490f"
     },
+    "ghcr.io/github/github-mcp-server:v1.12.2": {
+      "image": "ghcr.io/github/github-mcp-server:v1.12.2",
+      "digest": "sha256:508a0857ec762b1ab1cece29193345b501fab1dd9d1228a7b617062954cecac6",
+      "pinned_image": "ghcr.io/github/github-mcp-server:v1.12.2@sha256:508a0857ec762b1ab1cece29193345b501fab1dd9d1228a7b617062954cecac6"
+    },
     "ghcr.io/github/github-mcp-server:v2.0.2": {
       "image": "ghcr.io/github/github-mcp-server:v2.0.2",
       "digest": "sha256:ffced0d76e77428532a2ced185516992d77fd146d69eec2f244e6237d1a97796",
diff --git a/.github/workflows/smoke-enclave-issues-read.lock.yml b/.github/workflows/smoke-enclave-issues-read.lock.yml
index eef4a795a..cef8157ea 100644
--- a/.github/workflows/smoke-enclave-issues-read.lock.yml
+++ b/.github/workflows/smoke-enclave-issues-read.lock.yml
@@ -1,5 +1,5 @@
-# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"7588cabdf16eace9c6387e150539b2e3add22111314fb9875a08d303d1580e4f","body_hash":"8b9b459f0dad3eef1a1b7f21b1351bad55e21d4e9fa49218976c7ce1081d460e","compiler_version":"v0.92.6","agent_id":"copilot","engine_versions":{"copilot":"1.0.80"}}
-# gh-aw-manifest: {"version":1,"secrets":["GH_AW_DEFAULT_OTLP_ENDPOINT","GH_AW_DEFAULT_OTLP_HEADERS","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/checkout","sha":"3d3c42e5aac5ba805825da76410c181273ba90b1","version":"v7.0.1"},{"repo":"actions/download-artifact","sha":"9000827ccba6bdab643e8b6fd33ac0654aef8333","version":"v8.0.2"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/upload-artifact","sha":"cf430e030ddbb5b0abf93d22962f4752f3646cd9","version":"v7.0.2"},{"repo":"github/gh-aw-actions/setup","sha":"8b9c5e98dfe3472ac4e3f13e0a2441cd078a2ca7","version":"v0.92.6"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.28.13","digest":"sha256:78aeb1eee876d1ebae5eef26402bd9f31112850d42016a240002d1da57203e15","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.28.13@sha256:78aeb1eee876d1ebae5eef26402bd9f31112850d42016a240002d1da57203e15"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.28.13","digest":"sha256:61f12dcff38eb008b645d87a5541763452f409d9040eb243718764944167b1a2","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.28.13@sha256:61f12dcff38eb008b645d87a5541763452f409d9040eb243718764944167b1a2"},{"image":"ghcr.io/github/gh-aw-firewall/enclave-agent:0.28.13","digest":"sha256:13db988aacd5dbd6e43815faaeb42af6bf6f8b4f824b5fa88fd4f4f329203441","pinned_image":"ghcr.io/github/gh-aw-firewall/enclave-agent:0.28.13@sha256:13db988aacd5dbd6e43815faaeb42af6bf6f8b4f824b5fa88fd4f4f329203441"},{"image":"ghcr.io/github/gh-aw-firewall/enclave-mcp-server:0.28.13","digest":"sha256:ed8b1b2fd160e6b32b69352f3df8b24dfb3b286e77695c95c11fa940617467b2","pinned_image":"ghcr.io/github/gh-aw-firewall/enclave-mcp-server:0.28.13@sha256:ed8b1b2fd160e6b32b69352f3df8b24dfb3b286e77695c95c11fa940617467b2"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.28.13","digest":"sha256:58a8dc5be3fbafeef7da0532c38bd9047f86bf1b3c4cfd7d9b7d8d28e80a2b56","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.28.13@sha256:58a8dc5be3fbafeef7da0532c38bd9047f86bf1b3c4cfd7d9b7d8d28e80a2b56"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.4.15","digest":"sha256:60cd97533e93d8e7be36b979c0f08a70846189bda6190f28bbd6d427bc0d9b6e","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.4.15@sha256:60cd97533e93d8e7be36b979c0f08a70846189bda6190f28bbd6d427bc0d9b6e"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:11c2c544876cdbaffefe0f7f1283b74838c209654b4934a78e23ed11f750490f","pinned_image":"ghcr.io/github/gh-aw-node@sha256:11c2c544876cdbaffefe0f7f1283b74838c209654b4934a78e23ed11f750490f"},{"image":"ghcr.io/github/github-mcp-server:v1.12.2","digest":"sha256:508a0857ec762b1ab1cece29193345b501fab1dd9d1228a7b617062954cecac6","pinned_image":"ghcr.io/github/github-mcp-server:v1.12.2@sha256:508a0857ec762b1ab1cece29193345b501fab1dd9d1228a7b617062954cecac6"}],"mcp_servers":[{"name":"awf-enclave","tools":["*"]},{"name":"github","tools":["get_commit","get_file_contents","get_latest_release","get_me","get_pull_request","get_pull_request_comments","get_pull_request_diff","get_pull_request_files","get_pull_request_review_comments","get_pull_request_reviews","get_pull_request_status","get_release_by_tag","get_tag","issue_read","list_branches","list_commits","list_issue_types","list_issues","list_pull_requests","list_releases","list_starred_repositories","list_tags","pull_request_read","search_code","search_issues","search_pull_requests","search_repositories"]},{"name":"safeoutputs","tools":["create_issue","missing_data","missing_tool","noop","report_incomplete"]}],"threat_detection":{"mode":"disabled"}}
+# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"bdd01c2b9b5542e4f6b553ea33737c9af4fc77d551c0fc5ce00d12aa3ade8954","body_hash":"5b9cf6ab9095698a67981200ec7553f053a92cdff9869997721e37f22c963c51","compiler_version":"v0.92.6","agent_id":"copilot","engine_versions":{"copilot":"1.0.80"}}
+# gh-aw-manifest: {"version":1,"secrets":["GH_AW_DEFAULT_OTLP_ENDPOINT","GH_AW_DEFAULT_OTLP_HEADERS","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/checkout","sha":"3d3c42e5aac5ba805825da76410c181273ba90b1","version":"v7.0.1"},{"repo":"actions/download-artifact","sha":"9000827ccba6bdab643e8b6fd33ac0654aef8333","version":"v8.0.2"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/upload-artifact","sha":"cf430e030ddbb5b0abf93d22962f4752f3646cd9","version":"v7.0.2"},{"repo":"github/gh-aw-actions/setup","sha":"8b9c5e98dfe3472ac4e3f13e0a2441cd078a2ca7","version":"v0.92.6"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.28.13","digest":"sha256:78aeb1eee876d1ebae5eef26402bd9f31112850d42016a240002d1da57203e15","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.28.13@sha256:78aeb1eee876d1ebae5eef26402bd9f31112850d42016a240002d1da57203e15"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.28.13","digest":"sha256:61f12dcff38eb008b645d87a5541763452f409d9040eb243718764944167b1a2","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.28.13@sha256:61f12dcff38eb008b645d87a5541763452f409d9040eb243718764944167b1a2"},{"image":"ghcr.io/github/gh-aw-firewall/enclave-agent:0.28.13","digest":"sha256:13db988aacd5dbd6e43815faaeb42af6bf6f8b4f824b5fa88fd4f4f329203441","pinned_image":"ghcr.io/github/gh-aw-firewall/enclave-agent:0.28.13@sha256:13db988aacd5dbd6e43815faaeb42af6bf6f8b4f824b5fa88fd4f4f329203441"},{"image":"ghcr.io/github/gh-aw-firewall/enclave-mcp-server:0.28.13","digest":"sha256:ed8b1b2fd160e6b32b69352f3df8b24dfb3b286e77695c95c11fa940617467b2","pinned_image":"ghcr.io/github/gh-aw-firewall/enclave-mcp-server:0.28.13@sha256:ed8b1b2fd160e6b32b69352f3df8b24dfb3b286e77695c95c11fa940617467b2"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.28.13","digest":"sha256:58a8dc5be3fbafeef7da0532c38bd9047f86bf1b3c4cfd7d9b7d8d28e80a2b56","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.28.13@sha256:58a8dc5be3fbafeef7da0532c38bd9047f86bf1b3c4cfd7d9b7d8d28e80a2b56"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.4.36","digest":"sha256:b4d2856018959c798b3e3f81ae4ab5b275e06354e123e1f7971de931f2f450f2","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.4.36@sha256:b4d2856018959c798b3e3f81ae4ab5b275e06354e123e1f7971de931f2f450f2"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:11c2c544876cdbaffefe0f7f1283b74838c209654b4934a78e23ed11f750490f","pinned_image":"ghcr.io/github/gh-aw-node@sha256:11c2c544876cdbaffefe0f7f1283b74838c209654b4934a78e23ed11f750490f"},{"image":"ghcr.io/github/github-mcp-server:v1.12.2","digest":"sha256:508a0857ec762b1ab1cece29193345b501fab1dd9d1228a7b617062954cecac6","pinned_image":"ghcr.io/github/github-mcp-server:v1.12.2@sha256:508a0857ec762b1ab1cece29193345b501fab1dd9d1228a7b617062954cecac6"}],"mcp_servers":[{"name":"awf-enclave","tools":["*"]},{"name":"github","tools":["get_commit","get_file_contents","get_latest_release","get_me","get_pull_request","get_pull_request_comments","get_pull_request_diff","get_pull_request_files","get_pull_request_review_comments","get_pull_request_reviews","get_pull_request_status","get_release_by_tag","get_tag","issue_read","list_branches","list_commits","list_issue_types","list_issues","list_pull_requests","list_releases","list_starred_repositories","list_tags","pull_request_read","search_code","search_issues","search_pull_requests","search_repositories"]},{"name":"safeoutputs","tools":["create_issue","missing_data","missing_tool","noop","report_incomplete"]}],"threat_detection":{"mode":"disabled"}}
 # This file was automatically generated by gh-aw (v0.92.6). DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md
 #
 #    ___                   _   _
@@ -45,7 +45,7 @@
 #   -
 #   -
 #   -
-#   - ghcr.io/github/gh-aw-mcpg:v0.4.15@sha256:60cd97533e93d8e7be36b979c0f08a70846189bda6190f28bbd6d427bc0d9b6e
+#   - ghcr.io/github/gh-aw-mcpg:v0.4.36@sha256:b4d2856018959c798b3e3f81ae4ab5b275e06354e123e1f7971de931f2f450f2
 #   - ghcr.io/github/gh-aw-node@sha256:11c2c544876cdbaffefe0f7f1283b74838c209654b4934a78e23ed11f750490f
 #   - ghcr.io/github/github-mcp-server:v1.12.2@sha256:508a0857ec762b1ab1cece29193345b501fab1dd9d1228a7b617062954cecac6
 
@@ -142,7 +142,7 @@ jobs:
           GH_AW_INFO_ALLOWED_DOMAINS: '[]'
           GH_AW_INFO_FIREWALL_ENABLED: "true"
           GH_AW_INFO_AWF_VERSION: "v0.28.13"
-          GH_AW_INFO_AWMG_VERSION: "v0.4.15"
+          GH_AW_INFO_AWMG_VERSION: "v0.4.36"
           GH_AW_INFO_FIREWALL_TYPE: "squid"
           GH_AW_INFO_AGENT_RUNTIME: ""
           GH_AW_COMPILED_STRICT: "false"
@@ -565,7 +565,7 @@ jobs:
           GH_AW_SKILL_DIR: ".github/skills"
         run: bash "${RUNNER_TEMP}/gh-aw/actions/restore_inline_skills.sh"
       - name: Download container images
-        run: bash "${RUNNER_TEMP}/gh-aw/actions/download_docker_images.sh" ghcr.io/github/gh-aw-mcpg:v0.4.15@sha256:60cd97533e93d8e7be36b979c0f08a70846189bda6190f28bbd6d427bc0d9b6e ghcr.io/github/gh-aw-node@sha256:11c2c544876cdbaffefe0f7f1283b74838c209654b4934a78e23ed11f750490f ghcr.io/github/github-mcp-server:v1.12.2@sha256:508a0857ec762b1ab1cece29193345b501fab1dd9d1228a7b617062954cecac6
+        run: bash "${RUNNER_TEMP}/gh-aw/actions/download_docker_images.sh" ghcr.io/github/gh-aw-mcpg:v0.4.36@sha256:b4d2856018959c798b3e3f81ae4ab5b275e06354e123e1f7971de931f2f450f2 ghcr.io/github/gh-aw-node@sha256:11c2c544876cdbaffefe0f7f1283b74838c209654b4934a78e23ed11f750490f ghcr.io/github/github-mcp-server:v1.12.2@sha256:508a0857ec762b1ab1cece29193345b501fab1dd9d1228a7b617062954cecac6
       - name: Prepare Safe Outputs Directories
         run: |
           mkdir -p "${RUNNER_TEMP}/gh-aw/safeoutputs"
@@ -783,7 +783,7 @@ jobs:
           MCP_GATEWAY_UID=$(id -u 2>/dev/null || echo '0')
           MCP_GATEWAY_GID=$(id -g 2>/dev/null || echo '0')
           source "${RUNNER_TEMP}/gh-aw/actions/resolve_docker_socket_gid.sh"
-          export MCP_GATEWAY_DOCKER_COMMAND='docker run -i --rm --network bridge -p 127.0.0.1:'"${MCP_GATEWAY_PORT}"':'"${MCP_GATEWAY_PORT}"' --name awmg-mcpg --label com.github.gh-aw.mcpg.run='"${AWF_ENCLAVE_MCP_GATEWAY_IDENTITY}"' --add-host host.docker.internal:host-gateway --user '"${MCP_GATEWAY_UID}"':'"${MCP_GATEWAY_GID}"' --group-add '"${DOCKER_SOCK_GID}"' -v '"${DOCKER_SOCK_PATH}"':/var/run/docker.sock -e MCP_GATEWAY_PORT -e MCP_GATEWAY_DOMAIN -e MCP_GATEWAY_AGENT_ID -e MCP_GATEWAY_PAYLOAD_DIR -e MCP_GATEWAY_PAYLOAD_SIZE_THRESHOLD -e DOCKER_HOST=unix:///var/run/docker.sock -e DEBUG -e MCP_GATEWAY_LOG_DIR -e GH_AW_MCP_LOG_DIR -e GH_AW_SAFE_OUTPUTS -e GH_AW_SAFE_OUTPUTS_CONFIG_PATH -e GH_AW_SAFE_OUTPUTS_TOOLS_PATH -e GH_AW_TARGET_REPO_SLUG -e GH_AW_PR_HEAD_BASE_BRANCH -e GH_AW_PR_HEAD_BASE_SHA -e GH_AW_PR_HEAD_BASE_REPO -e GH_AW_PR_HEAD_BASE_PR_NUMBER -e GH_AW_PR_HEAD_BASE_REF -e GH_AW_PR_HEAD_REPO -e GH_AW_POLICY_ALLOW_CREATE_PULL_REQUEST -e GH_AW_ASSETS_BRANCH -e GH_AW_ASSETS_MAX_SIZE_KB -e GH_AW_ASSETS_ALLOWED_EXTS -e DEFAULT_BRANCH -e GITHUB_MCP_SERVER_TOKEN -e GITHUB_MCP_GUARD_MIN_INTEGRITY -e GITHUB_MCP_GUARD_REPOS -e GH_AW_SINK_VISIBILITY -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_SHA -e GITHUB_WORKSPACE -e GITHUB_TOKEN -e GITHUB_RUN_ID -e GITHUB_RUN_NUMBER -e GITHUB_RUN_ATTEMPT -e GITHUB_JOB -e GITHUB_ACTION -e GITHUB_EVENT_NAME -e GITHUB_EVENT_PATH -e GITHUB_ACTOR -e GITHUB_ACTOR_ID -e GITHUB_TRIGGERING_ACTOR -e GITHUB_WORKFLOW -e GITHUB_WORKFLOW_REF -e GITHUB_WORKFLOW_SHA -e GITHUB_REF -e GITHUB_REF_NAME -e GITHUB_REF_TYPE -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e RUNNER_TEMP -e RUNNER_TOOL_CACHE -e MCP_GATEWAY_ALLOWED_MOUNT_ROOTS -e AWF_ENCLAVE_MCP_CAPABILITY -e GITHUB_AW_OTEL_TRACE_ID -e GITHUB_AW_OTEL_PARENT_SPAN_ID -e OTEL_EXPORTER_OTLP_HEADERS -v /tmp/gh-aw/mcp-payloads:/tmp/gh-aw/mcp-payloads:rw -v /opt:/opt:ro -v /tmp:/tmp:rw -v '"${GITHUB_WORKSPACE}"':'"${GITHUB_WORKSPACE}"':rw -v '"${RUNNER_TEMP}"'/gh-aw/safeoutputs:'"${RUNNER_TEMP}"'/gh-aw/safeoutputs:rw ghcr.io/github/gh-aw-mcpg:v0.4.15@sha256:60cd97533e93d8e7be36b979c0f08a70846189bda6190f28bbd6d427bc0d9b6e'
+          export MCP_GATEWAY_DOCKER_COMMAND='docker run -i --rm --network bridge -p 127.0.0.1:'"${MCP_GATEWAY_PORT}"':'"${MCP_GATEWAY_PORT}"' --name awmg-mcpg --label com.github.gh-aw.mcpg.run='"${AWF_ENCLAVE_MCP_GATEWAY_IDENTITY}"' --add-host host.docker.internal:host-gateway --user '"${MCP_GATEWAY_UID}"':'"${MCP_GATEWAY_GID}"' --group-add '"${DOCKER_SOCK_GID}"' -v '"${DOCKER_SOCK_PATH}"':/var/run/docker.sock -e MCP_GATEWAY_PORT -e MCP_GATEWAY_DOMAIN -e MCP_GATEWAY_AGENT_ID -e MCP_GATEWAY_PAYLOAD_DIR -e MCP_GATEWAY_PAYLOAD_SIZE_THRESHOLD -e DOCKER_HOST=unix:///var/run/docker.sock -e DEBUG -e MCP_GATEWAY_LOG_DIR -e GH_AW_MCP_LOG_DIR -e GH_AW_SAFE_OUTPUTS -e GH_AW_SAFE_OUTPUTS_CONFIG_PATH -e GH_AW_SAFE_OUTPUTS_TOOLS_PATH -e GH_AW_TARGET_REPO_SLUG -e GH_AW_PR_HEAD_BASE_BRANCH -e GH_AW_PR_HEAD_BASE_SHA -e GH_AW_PR_HEAD_BASE_REPO -e GH_AW_PR_HEAD_BASE_PR_NUMBER -e GH_AW_PR_HEAD_BASE_REF -e GH_AW_PR_HEAD_REPO -e GH_AW_POLICY_ALLOW_CREATE_PULL_REQUEST -e GH_AW_ASSETS_BRANCH -e GH_AW_ASSETS_MAX_SIZE_KB -e GH_AW_ASSETS_ALLOWED_EXTS -e DEFAULT_BRANCH -e GITHUB_MCP_SERVER_TOKEN -e GITHUB_MCP_GUARD_MIN_INTEGRITY -e GITHUB_MCP_GUARD_REPOS -e GH_AW_SINK_VISIBILITY -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_SHA -e GITHUB_WORKSPACE -e GITHUB_TOKEN -e GITHUB_RUN_ID -e GITHUB_RUN_NUMBER -e GITHUB_RUN_ATTEMPT -e GITHUB_JOB -e GITHUB_ACTION -e GITHUB_EVENT_NAME -e GITHUB_EVENT_PATH -e GITHUB_ACTOR -e GITHUB_ACTOR_ID -e GITHUB_TRIGGERING_ACTOR -e GITHUB_WORKFLOW -e GITHUB_WORKFLOW_REF -e GITHUB_WORKFLOW_SHA -e GITHUB_REF -e GITHUB_REF_NAME -e GITHUB_REF_TYPE -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e RUNNER_TEMP -e RUNNER_TOOL_CACHE -e MCP_GATEWAY_ALLOWED_MOUNT_ROOTS -e AWF_ENCLAVE_MCP_CAPABILITY -e GITHUB_AW_OTEL_TRACE_ID -e GITHUB_AW_OTEL_PARENT_SPAN_ID -e OTEL_EXPORTER_OTLP_HEADERS -v /tmp/gh-aw/mcp-payloads:/tmp/gh-aw/mcp-payloads:rw -v /opt:/opt:ro -v /tmp:/tmp:rw -v '"${GITHUB_WORKSPACE}"':'"${GITHUB_WORKSPACE}"':rw -v '"${RUNNER_TEMP}"'/gh-aw/safeoutputs:'"${RUNNER_TEMP}"'/gh-aw/safeoutputs:rw ghcr.io/github/gh-aw-mcpg:v0.4.36@sha256:b4d2856018959c798b3e3f81ae4ab5b275e06354e123e1f7971de931f2f450f2'
 
           mkdir -p "$HOME/.copilot"
           GH_AW_NODE=$(which node 2>/dev/null || command -v node 2>/dev/null || echo node)
diff --git a/.github/workflows/smoke-enclave-issues-read.md b/.github/workflows/smoke-enclave-issues-read.md
index 0065d6d22..50258b0e6 100644
--- a/.github/workflows/smoke-enclave-issues-read.md
+++ b/.github/workflows/smoke-enclave-issues-read.md
@@ -40,7 +40,7 @@ sandbox:
     id: awf
     version: v0.28.13
   mcp:
-    version: v0.4.15
+    version: v0.4.36
 strict: false
 concurrency:
   group: smoke-enclave-issues-read
@@ -115,8 +115,10 @@ post-steps:
 # Smoke Test: Read-Only GitHub Issues from an Agent Enclave
 
 The postprocessor pins this smoke's GitHub MCP server to the last-green
-`v1.12.2` image: mcpg `v0.4.15` expects a flat issue object and comments array,
-not the `issue_read` envelopes introduced in GitHub MCP server v2. Keep
+`v1.12.2` image for the flat issue object and comments array expected by the
+gateway guard, not the `issue_read` envelopes introduced in GitHub MCP server
+v2. MCP Gateway `v0.4.36` additionally supports the immutable `@sha256` image
+reference; older gateways reject it during configuration validation. Keep
 `tools.github: false` and the enclave's `approved` integrity policy intact.
 
 The primary agent has no GitHub MCP tools, GitHub credentials, or external
diff --git a/scripts/ci/apply-general-workflow-patches.ts b/scripts/ci/apply-general-workflow-patches.ts
index a2190be78..979338f0f 100644
--- a/scripts/ci/apply-general-workflow-patches.ts
+++ b/scripts/ci/apply-general-workflow-patches.ts
@@ -94,7 +94,7 @@ export function applyGeneralWorkflowPatches(
 
   if (workflowPath.endsWith('smoke-enclave-issues-read.lock.yml')) {
     const original = content;
-    // v2 issue_read envelopes are incompatible with this smoke's v0.4.15 guard.
+    // v2 issue_read envelopes are incompatible with this smoke's gateway guard.
     // Keep the last-green flat-response server without weakening approved integrity.
     const githubImage = 'ghcr.io/github/github-mcp-server:v1.12.2';
     const githubDigest = 'sha256:508a0857ec762b1ab1cece29193345b501fab1dd9d1228a7b617062954cecac6';
diff --git a/scripts/ci/smoke-enclave-workflow.test.ts b/scripts/ci/smoke-enclave-workflow.test.ts
index 5f80b4a91..007a9ca87 100644
--- a/scripts/ci/smoke-enclave-workflow.test.ts
+++ b/scripts/ci/smoke-enclave-workflow.test.ts
@@ -1087,8 +1087,8 @@ describe('smoke enclave issues workflow', () => {
     expect(lock).toContain('--exclude-env MCP_GATEWAY_API_KEY');
   });
 
-  it('tests the local AWF implementation with mcpg v0.4.15', () => {
-    expect(lock).toContain('ghcr.io/github/gh-aw-mcpg:v0.4.15');
+  it('tests the local AWF implementation with mcpg v0.4.36', () => {
+    expect(lock).toContain('ghcr.io/github/gh-aw-mcpg:v0.4.36');
     expect(lock).toContain('Install awf binary (local)');
     expect(lock).toContain('--build-local');
     expect(lock).not.toMatch(
@@ -1096,6 +1096,53 @@ describe('smoke enclave issues workflow', () => {
     );
   });
 
+  it('accepts the emitted stdio image under the pinned gateway container schema', () => {
+    const frontmatter = yaml.load(source.split('---')[1]) as {
+      sandbox: { mcp: { version: string } };
+    };
+    const compiled = yaml.load(lock) as {
+      jobs: { agent: { steps: Array<{ name: string; run?: string }> } };
+    };
+    const gateway = compiled.jobs.agent.steps.find(step =>
+      step.name === 'Start MCP Gateway')?.run;
+    const images = Array.from(gateway?.matchAll(/"container": "([^"]+)"/g) ?? [],
+      match => match[1]);
+    // Exact container subschemas from internal/config/schema/mcp-gateway-config.schema.json
+    // at github/gh-aw-mcpg v0.4.15 and v0.4.36 (fix: github/gh-aw-mcpg#15212).
+    const legacyPattern = '^[a-zA-Z0-9][a-zA-Z0-9./_-]*(:([a-zA-Z0-9._-]+|latest))?$';
+    const digestPattern =
+      '^[a-zA-Z0-9][a-zA-Z0-9./_-]*(:([a-zA-Z0-9._-]+|latest))?(@sha256:[a-fA-F0-9]{64})?$';
+    const ajv = new Ajv();
+    const legacy = ajv.compile({ type: 'string', minLength: 1, pattern: legacyPattern });
+    const compatible = ajv.compile({ type: 'string', minLength: 1, pattern: digestPattern });
+    expect(frontmatter.sandbox.mcp.version).toBe('v0.4.36');
+    const gatewayImage = `ghcr.io/github/gh-aw-mcpg:${frontmatter.sandbox.mcp.version}`;
+    const gatewayDigest = 'sha256:b4d2856018959c798b3e3f81ae4ab5b275e06354e123e1f7971de931f2f450f2';
+    const pinnedGateway = `${gatewayImage}@${gatewayDigest}`;
+    const manifest = JSON.parse(lock.match(/^# gh-aw-manifest: (.+)$/m)![1]) as {
+      containers: Array<{ image: string; digest: string; pinned_image: string }>;
+    };
+    expect(manifest.containers.filter(container => container.image === gatewayImage))
+      .toEqual([{ image: gatewayImage, digest: gatewayDigest, pinned_image: pinnedGateway }]);
+    expect(gateway).toContain(pinnedGateway);
+    expect(compiled.jobs.agent.steps.find(step =>
+      step.name === 'Download container images')?.run).toContain(pinnedGateway);
+    const pins = JSON.parse(fs.readFileSync(
+      path.join(workflowsDir, '..', 'aw', 'actions-lock.json'), 'utf8')) as {
+      containers: Record<string, { pinned_image: string }>;
+    };
+    expect(pins.containers[gatewayImage].pinned_image).toBe(pinnedGateway);
+    expect(images).toHaveLength(2);
+    const githubImage = images.find(image =>
+      image.startsWith('ghcr.io/github/github-mcp-server:'));
+    if (!githubImage) throw new Error('Generated gateway configuration lacks the GitHub stdio image');
+    expect(legacy(githubImage)).toBe(false);
+    for (const image of images) expect(compatible(image)).toBe(true);
+    expect(compatible(githubImage.slice(0, -1))).toBe(false);
+    expect(compatible(githubImage.replace(/.$/, 'g'))).toBe(false);
+    expect(compatible(githubImage.replace('@sha256:', '@sha512:'))).toBe(false);
+  });
+
   it('pins the last-green flat-response GitHub server in runtime and manifest', () => {
     const image = 'ghcr.io/github/github-mcp-server:v1.12.2';
     const digest = 'sha256:508a0857ec762b1ab1cece29193345b501fab1dd9d1228a7b617062954cecac6';
@@ -1127,7 +1174,7 @@ describe('smoke enclave issues workflow', () => {
   });
 
   it('rejects v2 envelopes even when the nested issue author is approved', () => {
-    // mcpg v0.4.15 labels the returned object itself, not a nested "issue".
+    // The pinned gateway labels the returned object itself, not a nested "issue".
     const ajv = new Ajv();
     const issue = ajv.compile({
       type: 'object',

From e7eebb510a8a211934786dc314460c3663c3562c Mon Sep 17 00:00:00 2001
From: Landon Cox <landon.cox@microsoft.com>
Date: Tue, 20 Oct 2026 15:38:00 -0700
Subject: [PATCH 3/6] Modify container image replacement logic

Update container image handling for mcpg v0.4.15 compatibility.

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---
 scripts/ci/apply-general-workflow-patches.ts | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/scripts/ci/apply-general-workflow-patches.ts b/scripts/ci/apply-general-workflow-patches.ts
index 979338f0f..dd25e3cc7 100644
--- a/scripts/ci/apply-general-workflow-patches.ts
+++ b/scripts/ci/apply-general-workflow-patches.ts
@@ -103,6 +103,10 @@ export function applyGeneralWorkflowPatches(
       /ghcr\.io\/github\/github-mcp-server:[\w.-]+(?:@sha256:[a-f0-9]{64})?/g,
       pinnedGithubImage
     );
+    // mcpg v0.4.15 accepts tags, not digest-qualified stdio container values.
+    content = content
+      .split(`"container": "${pinnedGithubImage}"`)
+      .join(`"container": "${githubImage}"`);
     content = content.replace(
       /^(# gh-aw-manifest: )(.+)$/m,
       (_match, prefix: string, json: string) => {

From 95ab665327fb161f6346fb22408836c83d8e0e31 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 20 Oct 2026 22:41:17 +0000
Subject: [PATCH 4/6] fix: preserve pinned enclave MCP runtime image

---
 .../ci/apply-general-workflow-patches.test.ts | 27 +++++++++++++++++++
 scripts/ci/apply-general-workflow-patches.ts  |  4 ---
 2 files changed, 27 insertions(+), 4 deletions(-)

diff --git a/scripts/ci/apply-general-workflow-patches.test.ts b/scripts/ci/apply-general-workflow-patches.test.ts
index e4b57aaca..ff1422fb2 100644
--- a/scripts/ci/apply-general-workflow-patches.test.ts
+++ b/scripts/ci/apply-general-workflow-patches.test.ts
@@ -228,6 +228,33 @@ describe('applyGeneralWorkflowPatches Cloud Hypervisor bundle retries', () => {
 });
 
 describe('applyGeneralWorkflowPatches shared enclave gateway policy', () => {
+  it('keeps the immutable GitHub MCP image in runtime configuration', () => {
+    const image = 'ghcr.io/github/github-mcp-server:v1.12.2';
+    const digest = 'sha256:508a0857ec762b1ab1cece29193345b501fab1dd9d1228a7b617062954cecac6';
+    const pinned = `${image}@${digest}`;
+    const compiled = [
+      `# gh-aw-manifest: ${JSON.stringify({
+        version: 1,
+        containers: [{ image, digest, pinned_image: image }],
+      })}`,
+      `download_docker_images.sh ${image}`,
+      `"container": "${image}"`,
+      '"awf-enclave": {\n                "type": "http",',
+      '      - name: Execute GitHub Copilot CLI\n        env:\n          MCP_GATEWAY_API_KEY: ${{ steps.start-mcp-gateway.outputs.gateway-api-key }}\n        run: awf --exclude-env MCP_GATEWAY_AGENT_ID',
+    ].join('\n');
+
+    const workflowPath = '/tmp/workflows/smoke-enclave-issues-read.lock.yml';
+    const { content } = applyGeneralWorkflowPatches(compiled, workflowPath);
+    const manifest = JSON.parse(content.match(/^# gh-aw-manifest: (.+)$/m)![1]) as {
+      containers: Array<{ image: string; digest: string; pinned_image: string }>;
+    };
+
+    expect(manifest.containers).toEqual([{ image, digest, pinned_image: pinned }]);
+    expect(content).toContain(`download_docker_images.sh ${pinned}`);
+    expect(content).toContain(`"container": "${pinned}"`);
+    expect(applyGeneralWorkflowPatches(content, workflowPath).content).toBe(content);
+  });
+
   it.each([
     'smoke-enclave-cloud-hypervisor.lock.yml',
   ])('restores the host-only rootfs exclusion in %s idempotently', filename => {
diff --git a/scripts/ci/apply-general-workflow-patches.ts b/scripts/ci/apply-general-workflow-patches.ts
index dd25e3cc7..979338f0f 100644
--- a/scripts/ci/apply-general-workflow-patches.ts
+++ b/scripts/ci/apply-general-workflow-patches.ts
@@ -103,10 +103,6 @@ export function applyGeneralWorkflowPatches(
       /ghcr\.io\/github\/github-mcp-server:[\w.-]+(?:@sha256:[a-f0-9]{64})?/g,
       pinnedGithubImage
     );
-    // mcpg v0.4.15 accepts tags, not digest-qualified stdio container values.
-    content = content
-      .split(`"container": "${pinnedGithubImage}"`)
-      .join(`"container": "${githubImage}"`);
     content = content.replace(
       /^(# gh-aw-manifest: )(.+)$/m,
       (_match, prefix: string, json: string) => {

From 930c44b9f530609b1b5eb2996e14177db1f37de5 Mon Sep 17 00:00:00 2001
From: Landon Cox <landon.cox@microsoft.com>
Date: Tue, 20 Oct 2026 15:48:27 -0700
Subject: [PATCH 5/6] fix: allow strict preflight for enclave Issues smoke

Keep the same immutable gateway pin in the static smoke postprocessor instead of the compiler-internal sandbox.mcp.version field. Preserve generated runtime behavior and metadata while allowing the required strict dry-run gate.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 89c6ca75-abc8-456b-847f-01055d487e63
---
 .../smoke-enclave-issues-read.lock.yml         |  2 +-
 .github/workflows/smoke-enclave-issues-read.md |  8 ++++----
 scripts/ci/apply-general-workflow-patches.ts   | 14 ++++++++++++++
 scripts/ci/smoke-enclave-workflow.test.ts      | 18 +++++++++++++++---
 4 files changed, 34 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/smoke-enclave-issues-read.lock.yml b/.github/workflows/smoke-enclave-issues-read.lock.yml
index cef8157ea..07e6bdce0 100644
--- a/.github/workflows/smoke-enclave-issues-read.lock.yml
+++ b/.github/workflows/smoke-enclave-issues-read.lock.yml
@@ -1,4 +1,4 @@
-# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"bdd01c2b9b5542e4f6b553ea33737c9af4fc77d551c0fc5ce00d12aa3ade8954","body_hash":"5b9cf6ab9095698a67981200ec7553f053a92cdff9869997721e37f22c963c51","compiler_version":"v0.92.6","agent_id":"copilot","engine_versions":{"copilot":"1.0.80"}}
+# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"3ef79c06d257cc2c122005ab033f4392db9e297ac58dea907d507ffc048ff66b","body_hash":"223b2df09458c6ba44a7eb7d197b7fc74ff9c3f0643a5af501173d8bfdb66ed7","compiler_version":"v0.92.6","agent_id":"copilot","engine_versions":{"copilot":"1.0.80"}}
 # gh-aw-manifest: {"version":1,"secrets":["GH_AW_DEFAULT_OTLP_ENDPOINT","GH_AW_DEFAULT_OTLP_HEADERS","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/checkout","sha":"3d3c42e5aac5ba805825da76410c181273ba90b1","version":"v7.0.1"},{"repo":"actions/download-artifact","sha":"9000827ccba6bdab643e8b6fd33ac0654aef8333","version":"v8.0.2"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/upload-artifact","sha":"cf430e030ddbb5b0abf93d22962f4752f3646cd9","version":"v7.0.2"},{"repo":"github/gh-aw-actions/setup","sha":"8b9c5e98dfe3472ac4e3f13e0a2441cd078a2ca7","version":"v0.92.6"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.28.13","digest":"sha256:78aeb1eee876d1ebae5eef26402bd9f31112850d42016a240002d1da57203e15","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.28.13@sha256:78aeb1eee876d1ebae5eef26402bd9f31112850d42016a240002d1da57203e15"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.28.13","digest":"sha256:61f12dcff38eb008b645d87a5541763452f409d9040eb243718764944167b1a2","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.28.13@sha256:61f12dcff38eb008b645d87a5541763452f409d9040eb243718764944167b1a2"},{"image":"ghcr.io/github/gh-aw-firewall/enclave-agent:0.28.13","digest":"sha256:13db988aacd5dbd6e43815faaeb42af6bf6f8b4f824b5fa88fd4f4f329203441","pinned_image":"ghcr.io/github/gh-aw-firewall/enclave-agent:0.28.13@sha256:13db988aacd5dbd6e43815faaeb42af6bf6f8b4f824b5fa88fd4f4f329203441"},{"image":"ghcr.io/github/gh-aw-firewall/enclave-mcp-server:0.28.13","digest":"sha256:ed8b1b2fd160e6b32b69352f3df8b24dfb3b286e77695c95c11fa940617467b2","pinned_image":"ghcr.io/github/gh-aw-firewall/enclave-mcp-server:0.28.13@sha256:ed8b1b2fd160e6b32b69352f3df8b24dfb3b286e77695c95c11fa940617467b2"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.28.13","digest":"sha256:58a8dc5be3fbafeef7da0532c38bd9047f86bf1b3c4cfd7d9b7d8d28e80a2b56","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.28.13@sha256:58a8dc5be3fbafeef7da0532c38bd9047f86bf1b3c4cfd7d9b7d8d28e80a2b56"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.4.36","digest":"sha256:b4d2856018959c798b3e3f81ae4ab5b275e06354e123e1f7971de931f2f450f2","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.4.36@sha256:b4d2856018959c798b3e3f81ae4ab5b275e06354e123e1f7971de931f2f450f2"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:11c2c544876cdbaffefe0f7f1283b74838c209654b4934a78e23ed11f750490f","pinned_image":"ghcr.io/github/gh-aw-node@sha256:11c2c544876cdbaffefe0f7f1283b74838c209654b4934a78e23ed11f750490f"},{"image":"ghcr.io/github/github-mcp-server:v1.12.2","digest":"sha256:508a0857ec762b1ab1cece29193345b501fab1dd9d1228a7b617062954cecac6","pinned_image":"ghcr.io/github/github-mcp-server:v1.12.2@sha256:508a0857ec762b1ab1cece29193345b501fab1dd9d1228a7b617062954cecac6"}],"mcp_servers":[{"name":"awf-enclave","tools":["*"]},{"name":"github","tools":["get_commit","get_file_contents","get_latest_release","get_me","get_pull_request","get_pull_request_comments","get_pull_request_diff","get_pull_request_files","get_pull_request_review_comments","get_pull_request_reviews","get_pull_request_status","get_release_by_tag","get_tag","issue_read","list_branches","list_commits","list_issue_types","list_issues","list_pull_requests","list_releases","list_starred_repositories","list_tags","pull_request_read","search_code","search_issues","search_pull_requests","search_repositories"]},{"name":"safeoutputs","tools":["create_issue","missing_data","missing_tool","noop","report_incomplete"]}],"threat_detection":{"mode":"disabled"}}
 # This file was automatically generated by gh-aw (v0.92.6). DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md
 #
diff --git a/.github/workflows/smoke-enclave-issues-read.md b/.github/workflows/smoke-enclave-issues-read.md
index 50258b0e6..2701384c3 100644
--- a/.github/workflows/smoke-enclave-issues-read.md
+++ b/.github/workflows/smoke-enclave-issues-read.md
@@ -39,8 +39,6 @@ sandbox:
   agent:
     id: awf
     version: v0.28.13
-  mcp:
-    version: v0.4.36
 strict: false
 concurrency:
   group: smoke-enclave-issues-read
@@ -117,8 +115,10 @@ post-steps:
 The postprocessor pins this smoke's GitHub MCP server to the last-green
 `v1.12.2` image for the flat issue object and comments array expected by the
 gateway guard, not the `issue_read` envelopes introduced in GitHub MCP server
-v2. MCP Gateway `v0.4.36` additionally supports the immutable `@sha256` image
-reference; older gateways reject it during configuration validation. Keep
+v2. The postprocessor also pins MCP Gateway `v0.4.36`, which supports the immutable
+`@sha256` image reference; older gateways reject it during configuration validation.
+The gateway implementation pin stays out of workflow frontmatter so strict
+validation remains supported. Keep
 `tools.github: false` and the enclave's `approved` integrity policy intact.
 
 The primary agent has no GitHub MCP tools, GitHub credentials, or external
diff --git a/scripts/ci/apply-general-workflow-patches.ts b/scripts/ci/apply-general-workflow-patches.ts
index 979338f0f..e22b46b2f 100644
--- a/scripts/ci/apply-general-workflow-patches.ts
+++ b/scripts/ci/apply-general-workflow-patches.ts
@@ -94,6 +94,15 @@ export function applyGeneralWorkflowPatches(
 
   if (workflowPath.endsWith('smoke-enclave-issues-read.lock.yml')) {
     const original = content;
+    // Strict compilation disallows sandbox.mcp.version; keep implementation pins here.
+    const gatewayImage = 'ghcr.io/github/gh-aw-mcpg:v0.4.36';
+    const gatewayDigest = 'sha256:b4d2856018959c798b3e3f81ae4ab5b275e06354e123e1f7971de931f2f450f2';
+    const pinnedGatewayImage = `${gatewayImage}@${gatewayDigest}`;
+    content = content.replace(
+      /ghcr\.io\/github\/gh-aw-mcpg:[\w.-]+(?:@sha256:[a-f0-9]{64})?/g,
+      pinnedGatewayImage
+    );
+    content = content.replace(/(GH_AW_INFO_AWMG_VERSION: ")[^"]*(")/g, '$1v0.4.36$2');
     // v2 issue_read envelopes are incompatible with this smoke's gateway guard.
     // Keep the last-green flat-response server without weakening approved integrity.
     const githubImage = 'ghcr.io/github/github-mcp-server:v1.12.2';
@@ -110,6 +119,11 @@ export function applyGeneralWorkflowPatches(
           containers?: Array<{ image: string; digest: string; pinned_image: string }>;
         };
         for (const container of manifest.containers ?? []) {
+          if (container.image === pinnedGatewayImage) {
+            container.image = gatewayImage;
+            container.digest = gatewayDigest;
+            container.pinned_image = pinnedGatewayImage;
+          }
           if (container.image === pinnedGithubImage) {
             container.image = githubImage;
             container.digest = githubDigest;
diff --git a/scripts/ci/smoke-enclave-workflow.test.ts b/scripts/ci/smoke-enclave-workflow.test.ts
index 007a9ca87..c7bc0d9ae 100644
--- a/scripts/ci/smoke-enclave-workflow.test.ts
+++ b/scripts/ci/smoke-enclave-workflow.test.ts
@@ -1098,7 +1098,7 @@ describe('smoke enclave issues workflow', () => {
 
   it('accepts the emitted stdio image under the pinned gateway container schema', () => {
     const frontmatter = yaml.load(source.split('---')[1]) as {
-      sandbox: { mcp: { version: string } };
+      sandbox: { mcp?: { version?: string } };
     };
     const compiled = yaml.load(lock) as {
       jobs: { agent: { steps: Array<{ name: string; run?: string }> } };
@@ -1115,8 +1115,8 @@ describe('smoke enclave issues workflow', () => {
     const ajv = new Ajv();
     const legacy = ajv.compile({ type: 'string', minLength: 1, pattern: legacyPattern });
     const compatible = ajv.compile({ type: 'string', minLength: 1, pattern: digestPattern });
-    expect(frontmatter.sandbox.mcp.version).toBe('v0.4.36');
-    const gatewayImage = `ghcr.io/github/gh-aw-mcpg:${frontmatter.sandbox.mcp.version}`;
+    expect(frontmatter.sandbox.mcp?.version).toBeUndefined();
+    const gatewayImage = 'ghcr.io/github/gh-aw-mcpg:v0.4.36';
     const gatewayDigest = 'sha256:b4d2856018959c798b3e3f81ae4ab5b275e06354e123e1f7971de931f2f450f2';
     const pinnedGateway = `${gatewayImage}@${gatewayDigest}`;
     const manifest = JSON.parse(lock.match(/^# gh-aw-manifest: (.+)$/m)![1]) as {
@@ -1132,6 +1132,7 @@ describe('smoke enclave issues workflow', () => {
       containers: Record<string, { pinned_image: string }>;
     };
     expect(pins.containers[gatewayImage].pinned_image).toBe(pinnedGateway);
+    expect(lock).toContain('GH_AW_INFO_AWMG_VERSION: "v0.4.36"');
     expect(images).toHaveLength(2);
     const githubImage = images.find(image =>
       image.startsWith('ghcr.io/github/github-mcp-server:'));
@@ -1141,6 +1142,17 @@ describe('smoke enclave issues workflow', () => {
     expect(compatible(githubImage.slice(0, -1))).toBe(false);
     expect(compatible(githubImage.replace(/.$/, 'g'))).toBe(false);
     expect(compatible(githubImage.replace('@sha256:', '@sha512:'))).toBe(false);
+
+    const oldGateway = 'ghcr.io/github/gh-aw-mcpg:v0.4.15';
+    const oldDigest = `sha256:${'e'.repeat(64)}`;
+    const compilerOutput = lock.split(gatewayImage).join(oldGateway)
+      .split(gatewayDigest).join(oldDigest)
+      .replace('GH_AW_INFO_AWMG_VERSION: "v0.4.36"', 'GH_AW_INFO_AWMG_VERSION: ""');
+    const patched = applyGeneralWorkflowPatches(compilerOutput, issuesLockPath).content;
+    expect(patched).toBe(lock);
+    expect(applyGeneralWorkflowPatches(patched, issuesLockPath).content).toBe(patched);
+    expect(applyGeneralWorkflowPatches(compilerOutput, dynamicLockPath).content)
+      .toContain(`${oldGateway}@${oldDigest}`);
   });
 
   it('pins the last-green flat-response GitHub server in runtime and manifest', () => {

From 000143245111547c30ba5a764777c906829314e8 Mon Sep 17 00:00:00 2001
From: Landon Cox <landon.cox@microsoft.com>
Date: Tue, 20 Oct 2026 16:13:16 -0700
Subject: [PATCH 6/6] fix: patch dependency audit findings

Update the compatible markdown-it lock from 14.3.2 to 14.3.3. Raise the existing docs Vite override from 8.0.16 to the patched 8.1.6 release containing launch-editor 2.14.2, with npm-resolved bundler dependencies. Preserve the high/critical audit gates and avoid unrelated direct dependency changes.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 89c6ca75-abc8-456b-847f-01055d487e63
---
 docs-site/package-lock.json | 185 ++++++++++++++++--------------------
 docs-site/package.json      |   2 +-
 package-lock.json           |   6 +-
 3 files changed, 86 insertions(+), 107 deletions(-)

diff --git a/docs-site/package-lock.json b/docs-site/package-lock.json
index d1ade772b..a24246705 100644
--- a/docs-site/package-lock.json
+++ b/docs-site/package-lock.json
@@ -1765,9 +1765,9 @@
       "license": "MIT"
     },
     "node_modules/@oxc-project/types": {
-      "version": "0.133.0",
-      "resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.133.0.tgz",
-      "integrity": "sha512-KzkdCd6Uxqnf6l3HOw1xfatAlUURA0g14cvBYFyJ5SaNOQbOUvBr9PKArcPcrNIeRsBdgcUzOGrhKveVpvOIGA==",
+      "version": "0.139.0",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@oxc-project/types/-/types-0.139.0.tgz",
+      "integrity": "sha1-ONdrnb+TTCoCvhdPsyzuvxgv50I=",
       "license": "MIT",
       "funding": {
         "url": "https://github.com/sponsors/Boshen"
@@ -1871,9 +1871,9 @@
       ]
     },
     "node_modules/@rolldown/binding-android-arm64": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.0.3.tgz",
-      "integrity": "sha512-454rs7jHngixp/NMxd5srYD57OnzSlZ/eFTETjORQHLwJG1lRtmNOJcBerZlfu4GjKqeq8aCCIQrMdHyhI51Hw==",
+      "version": "1.1.5",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@rolldown/binding-android-arm64/-/binding-android-arm64-1.1.5.tgz",
+      "integrity": "sha1-9Yy5oKgSjtBYIoJyBShUf8XANfM=",
       "cpu": [
         "arm64"
       ],
@@ -1887,9 +1887,9 @@
       }
     },
     "node_modules/@rolldown/binding-darwin-arm64": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.0.3.tgz",
-      "integrity": "sha512-PcAhP+ynjURNyy8SKGl5DQP94aGuB/7JrXJb/t7P+hanXvQVMWzUvRRhBAcg/lNRadBhoUPqSoP4xw5tR/KBEA==",
+      "version": "1.1.5",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.1.5.tgz",
+      "integrity": "sha1-RBFEwFpKgxqnUmmrw6SjJDdOpwc=",
       "cpu": [
         "arm64"
       ],
@@ -1903,9 +1903,9 @@
       }
     },
     "node_modules/@rolldown/binding-darwin-x64": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.0.3.tgz",
-      "integrity": "sha512-9YpfeUvSE2RS7wysJ81uOZkXJz7f7Q55H2Gvp3VEw/EsahqDtrphrZ0EwDLK5vvKOzaCrBsjF8JmnMLcUt78Gg==",
+      "version": "1.1.5",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.1.5.tgz",
+      "integrity": "sha1-yC4wZSzvUsSvkl1cZsiVWkAxmBY=",
       "cpu": [
         "x64"
       ],
@@ -1919,9 +1919,9 @@
       }
     },
     "node_modules/@rolldown/binding-freebsd-x64": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.0.3.tgz",
-      "integrity": "sha512-yB1IlAsSNHncV6SCTL27/MVGR5htvQsoGxIv5KMGXALp+Ll1wYsn+x98M9MW7qa+NdSbvrrY7ANI4wLJ0n1e6g==",
+      "version": "1.1.5",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.1.5.tgz",
+      "integrity": "sha1-wy6c5/ocD7K4CROio6BcPpB9BrA=",
       "cpu": [
         "x64"
       ],
@@ -1935,9 +1935,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-arm-gnueabihf": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.0.3.tgz",
-      "integrity": "sha512-Yi30IVAAfLUCy2MseFjbB1jAMDl1VMCAas5StnYp8da9+CKvMd2H2cbEjWcw5NPaPqzvYkVIaF1nNUG+b7u/sw==",
+      "version": "1.1.5",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.1.5.tgz",
+      "integrity": "sha1-zpC14iMWretQLqAQWC9JjNBgTyc=",
       "cpu": [
         "arm"
       ],
@@ -1951,9 +1951,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-arm64-gnu": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.0.3.tgz",
-      "integrity": "sha512-jsO7R8To+AdlYgUmN5sHSCZbfhtMBkO0WUx8iORQnPcMMdgr7qM2DQmMwgabs3GhNztdmoKkMKQFHD6DTMCIQw==",
+      "version": "1.1.5",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.1.5.tgz",
+      "integrity": "sha1-kZRxEMTdqk7vsATlJogHCXcIUgE=",
       "cpu": [
         "arm64"
       ],
@@ -1967,9 +1967,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-arm64-musl": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.0.3.tgz",
-      "integrity": "sha512-VWkUHwWriDciit80wleYwKILoR/KMvxh/IdwS/paX+ZgpuRpCrKLUdadJbc0NpBEiyhpYawsJ73j9aCvOH+f7Q==",
+      "version": "1.1.5",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.1.5.tgz",
+      "integrity": "sha1-6zKy1BCMHHArkejN6KBD6uXKqU0=",
       "cpu": [
         "arm64"
       ],
@@ -1983,9 +1983,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-ppc64-gnu": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.0.3.tgz",
-      "integrity": "sha512-5f1laC0SlIR0yDbFCd8acUhvJIag6N3zC5P7oUPN6wX0aOma+uKJ0wBDH5aq7I1PVI2ttTlhJwzwRIBnLiSGEg==",
+      "version": "1.1.5",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.1.5.tgz",
+      "integrity": "sha1-zLlDwR5acmVcuwL8EWNUHOtkB4I=",
       "cpu": [
         "ppc64"
       ],
@@ -1999,9 +1999,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-s390x-gnu": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.0.3.tgz",
-      "integrity": "sha512-Iq4ko0r4XsgbrF/LunNgHtAGLRRVE2kXonAXQ/MV0mC6jQpMOhW1SvtZja2EhC/kd05++bP78dsqBeIQyYJ6Yg==",
+      "version": "1.1.5",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.1.5.tgz",
+      "integrity": "sha1-ozcx7lZ+kLdfrG5eVTB+iiswOPA=",
       "cpu": [
         "s390x"
       ],
@@ -2015,9 +2015,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-x64-gnu": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.0.3.tgz",
-      "integrity": "sha512-B8m6tD5+/N5FeNQFbKlLA/2yVq9ycQP1SeedyEYYKWBNR3ZQbkvIUcNnDNM03lO1l5F2roiiFJGgvoLLyZXtSg==",
+      "version": "1.1.5",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.1.5.tgz",
+      "integrity": "sha1-p0wBqqzt/BHDm2/rozpfoMZUlJ8=",
       "cpu": [
         "x64"
       ],
@@ -2031,9 +2031,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-x64-musl": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.0.3.tgz",
-      "integrity": "sha512-pSdpdUJHkuCxun9LE7jvgUB9qsRgaiyNNCX7m/AvHTcq67AiT/Yhoxvw5zPfhrM8k/BfP8ce/hMOpthKDpEUow==",
+      "version": "1.1.5",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.1.5.tgz",
+      "integrity": "sha1-KM0XhJT6HmXbpBIim1zlXE3Vy9E=",
       "cpu": [
         "x64"
       ],
@@ -2047,9 +2047,9 @@
       }
     },
     "node_modules/@rolldown/binding-openharmony-arm64": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.0.3.tgz",
-      "integrity": "sha512-OXXS3RKJgX2uLwM+gYyuH5omcH8fL1LJs96pZGgtetVCahON57+d4SJHzTgZiOjxgGkSnpXpOsWuPDGAKAigEg==",
+      "version": "1.1.5",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.1.5.tgz",
+      "integrity": "sha1-98dfqRP8IIhNJqfUiNT1xZfNccA=",
       "cpu": [
         "arm64"
       ],
@@ -2063,48 +2063,27 @@
       }
     },
     "node_modules/@rolldown/binding-wasm32-wasi": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-wasm32-wasi/-/binding-wasm32-wasi-1.0.3.tgz",
-      "integrity": "sha512-JTtb8BWFynicNSoPrehsCzBtOKjZ6jhMiPFEmOiuXg1Fl8dn2KHQob+GuPSGR0dryQa1PQJbzjF3dqO/whhjLg==",
+      "version": "1.1.5",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@rolldown/binding-wasm32-wasi/-/binding-wasm32-wasi-1.1.5.tgz",
+      "integrity": "sha1-w3lYGUd4cIHfNj6hBhQPzV/sJS0=",
       "cpu": [
         "wasm32"
       ],
       "license": "MIT",
       "optional": true,
       "dependencies": {
-        "@emnapi/core": "1.10.0",
-        "@emnapi/runtime": "1.10.0",
-        "@napi-rs/wasm-runtime": "^1.1.4"
+        "@emnapi/core": "1.11.1",
+        "@emnapi/runtime": "1.11.1",
+        "@napi-rs/wasm-runtime": "^1.1.6"
       },
       "engines": {
         "node": "^20.19.0 || >=22.12.0"
       }
     },
-    "node_modules/@rolldown/binding-wasm32-wasi/node_modules/@emnapi/core": {
-      "version": "1.10.0",
-      "resolved": "https://registry.npmjs.org/@emnapi/core/-/core-1.10.0.tgz",
-      "integrity": "sha512-yq6OkJ4p82CAfPl0u9mQebQHKPJkY7WrIuk205cTYnYe+k2Z8YBh11FrbRG/H6ihirqcacOgl2BIO8oyMQLeXw==",
-      "license": "MIT",
-      "optional": true,
-      "dependencies": {
-        "@emnapi/wasi-threads": "1.2.1",
-        "tslib": "^2.4.0"
-      }
-    },
     "node_modules/@rolldown/binding-wasm32-wasi/node_modules/@emnapi/runtime": {
-      "version": "1.10.0",
-      "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.10.0.tgz",
-      "integrity": "sha512-ewvYlk86xUoGI0zQRNq/mC+16R1QeDlKQy21Ki3oSYXNgLb45GV1P6A0M+/s6nyCuNDqe5VpaY84BzXGwVbwFA==",
-      "license": "MIT",
-      "optional": true,
-      "dependencies": {
-        "tslib": "^2.4.0"
-      }
-    },
-    "node_modules/@rolldown/binding-wasm32-wasi/node_modules/@emnapi/wasi-threads": {
-      "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/@emnapi/wasi-threads/-/wasi-threads-1.2.1.tgz",
-      "integrity": "sha512-uTII7OYF+/Mes/MrcIOYp5yOtSMLBWSIoLPpcgwipoiKbli6k322tcoFsxoIIxPDqW01SQGAgko4EzZi2BNv2w==",
+      "version": "1.11.1",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@emnapi/runtime/-/runtime-1.11.1.tgz",
+      "integrity": "sha1-WPHz1dgamxL3k6tojJY3GQECfCQ=",
       "license": "MIT",
       "optional": true,
       "dependencies": {
@@ -2112,9 +2091,9 @@
       }
     },
     "node_modules/@rolldown/binding-win32-arm64-msvc": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.0.3.tgz",
-      "integrity": "sha512-gEdFFEN70A/jxb2svrWsN3aDL7OUtmvlOy+6fa2jxG8K0wQ1ZbdeLGnidov6Yu5/733dI5ySfzFlQ/cb0bSz1g==",
+      "version": "1.1.5",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.1.5.tgz",
+      "integrity": "sha1-8jyIaU96cpoS85UCSu4434Cha6M=",
       "cpu": [
         "arm64"
       ],
@@ -2128,9 +2107,9 @@
       }
     },
     "node_modules/@rolldown/binding-win32-x64-msvc": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.0.3.tgz",
-      "integrity": "sha512-eXB7CHuaQdqmJcc3koCNtNPmT/bj2gc999kUFgBxG8Ac0NdgXc4rkCHhqrgrhN3zddvvvrgzj1e90SuSfmyIXA==",
+      "version": "1.1.5",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.1.5.tgz",
+      "integrity": "sha1-M3fI3g5WqIV/ESF1YRRwkOh0y0Y=",
       "cpu": [
         "x64"
       ],
@@ -2145,8 +2124,8 @@
     },
     "node_modules/@rolldown/pluginutils": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/@rolldown/pluginutils/-/pluginutils-1.0.1.tgz",
-      "integrity": "sha512-2j9bGt5Jh8hj+vPtgzPtl72j0yRxHAyumoo6TNfAjsLB04UtpSvPbPcDcBMxz7n+9CYB0c1GxQFxYRg2jimqGw==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@rolldown/pluginutils/-/pluginutils-1.0.1.tgz",
+      "integrity": "sha1-4/zuCT+7XOdl4a0Ij/TeKIn2+b4=",
       "license": "MIT"
     },
     "node_modules/@shikijs/core": {
@@ -6214,12 +6193,12 @@
       "license": "Unlicense"
     },
     "node_modules/rolldown": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.0.3.tgz",
-      "integrity": "sha512-i00lAJ2ks1BYr7rjNjKC7BcqAS7nVfiT3QX1SI5aY+AFHblCmaUf9OE9dbdzDvW6dJxbi2ZCZiy9v3CcwOiX3g==",
+      "version": "1.1.5",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/rolldown/-/rolldown-1.1.5.tgz",
+      "integrity": "sha1-M5quJQhENR/FW3TiZS0+vW+6OJ0=",
       "license": "MIT",
       "dependencies": {
-        "@oxc-project/types": "=0.133.0",
+        "@oxc-project/types": "=0.139.0",
         "@rolldown/pluginutils": "^1.0.0"
       },
       "bin": {
@@ -6229,21 +6208,21 @@
         "node": "^20.19.0 || >=22.12.0"
       },
       "optionalDependencies": {
-        "@rolldown/binding-android-arm64": "1.0.3",
-        "@rolldown/binding-darwin-arm64": "1.0.3",
-        "@rolldown/binding-darwin-x64": "1.0.3",
-        "@rolldown/binding-freebsd-x64": "1.0.3",
-        "@rolldown/binding-linux-arm-gnueabihf": "1.0.3",
-        "@rolldown/binding-linux-arm64-gnu": "1.0.3",
-        "@rolldown/binding-linux-arm64-musl": "1.0.3",
-        "@rolldown/binding-linux-ppc64-gnu": "1.0.3",
-        "@rolldown/binding-linux-s390x-gnu": "1.0.3",
-        "@rolldown/binding-linux-x64-gnu": "1.0.3",
-        "@rolldown/binding-linux-x64-musl": "1.0.3",
-        "@rolldown/binding-openharmony-arm64": "1.0.3",
-        "@rolldown/binding-wasm32-wasi": "1.0.3",
-        "@rolldown/binding-win32-arm64-msvc": "1.0.3",
-        "@rolldown/binding-win32-x64-msvc": "1.0.3"
+        "@rolldown/binding-android-arm64": "1.1.5",
+        "@rolldown/binding-darwin-arm64": "1.1.5",
+        "@rolldown/binding-darwin-x64": "1.1.5",
+        "@rolldown/binding-freebsd-x64": "1.1.5",
+        "@rolldown/binding-linux-arm-gnueabihf": "1.1.5",
+        "@rolldown/binding-linux-arm64-gnu": "1.1.5",
+        "@rolldown/binding-linux-arm64-musl": "1.1.5",
+        "@rolldown/binding-linux-ppc64-gnu": "1.1.5",
+        "@rolldown/binding-linux-s390x-gnu": "1.1.5",
+        "@rolldown/binding-linux-x64-gnu": "1.1.5",
+        "@rolldown/binding-linux-x64-musl": "1.1.5",
+        "@rolldown/binding-openharmony-arm64": "1.1.5",
+        "@rolldown/binding-wasm32-wasi": "1.1.5",
+        "@rolldown/binding-win32-arm64-msvc": "1.1.5",
+        "@rolldown/binding-win32-x64-msvc": "1.1.5"
       }
     },
     "node_modules/roughjs": {
@@ -6968,15 +6947,15 @@
       }
     },
     "node_modules/vite": {
-      "version": "8.0.16",
-      "resolved": "https://registry.npmjs.org/vite/-/vite-8.0.16.tgz",
-      "integrity": "sha512-h9bXPmJichP5fLmVQo3PyaGSDE2n3aPuomeAlVRm0JLmt4rY6zmPKd59HYI4LNW8oTK7tlTsuC7l/m7awx9Jcw==",
+      "version": "8.1.6",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/vite/-/vite-8.1.6.tgz",
+      "integrity": "sha512-aRAHIxx5SW5zc1sMqFwJU/t5qaFfXb5Hj0J7W0VXihu/X99+346tz6080tO1T1xVIJORX/b3zVTXGFqUXh35uw==",
       "license": "MIT",
       "dependencies": {
         "lightningcss": "^1.32.0",
-        "picomatch": "^4.0.4",
-        "postcss": "^8.5.15",
-        "rolldown": "1.0.3",
+        "picomatch": "^4.0.5",
+        "postcss": "^8.5.17",
+        "rolldown": "~1.1.5",
         "tinyglobby": "^0.2.17"
       },
       "bin": {
@@ -6993,7 +6972,7 @@
       },
       "peerDependencies": {
         "@types/node": "^20.19.0 || >=22.12.0",
-        "@vitejs/devtools": "^0.1.18",
+        "@vitejs/devtools": "^0.3.0",
         "esbuild": "^0.27.0 || ^0.28.0",
         "jiti": ">=1.21.0",
         "less": "^4.0.0",
diff --git a/docs-site/package.json b/docs-site/package.json
index 70ee3810f..7d6d5c52e 100644
--- a/docs-site/package.json
+++ b/docs-site/package.json
@@ -34,7 +34,7 @@
     "nanoid": "5.1.16",
     "postcss": "8.5.23",
     "svgo": "^4.1.0",
-    "vite": "8.0.16",
+    "vite": "8.1.6",
     "yaml": "^2.9.0",
     "dompurify": "3.4.16",
     "katex": "0.18.2",
diff --git a/package-lock.json b/package-lock.json
index 4d5bb3718..ea3ee9f0e 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -11556,9 +11556,9 @@
       "license": "ISC"
     },
     "node_modules/markdown-it": {
-      "version": "14.3.2",
-      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/markdown-it/-/markdown-it-14.3.2.tgz",
-      "integrity": "sha512-sHHjZ5fJKlgrG4qns2YwVcdNep35h5fERrfkD2YNsb9UFk0UIHarbiTaHKVMlPuWAoiilyK8Fv/jAm11slsY7Q==",
+      "version": "14.3.3",
+      "resolved": "https://registry.npmjs.org/markdown-it/-/markdown-it-14.3.3.tgz",
+      "integrity": "sha512-L//tDAkjTjJCU6pBUSBTgs3Kg4InVaZuUZog/b6V12UKhcDQ7S78877ibbCanRExwPuYP1CZD7Gd2dxSy1GXRg==",
       "dev": true,
       "funding": [
         {