Harden gojq walk_schema single-output contract and document jq binding safety

[Copilot]

The gojq review found no functional or security gaps in current usage, but flagged two high-value follow-ups: lock down walk_schema’s single-output invariant with stronger coverage and document variable-binding safety alongside existing $ENV hardening. This PR addresses those targeted follow-ups without changing runtime behavior.

• Contract coverage: walk_schema must emit exactly one value

  • Expanded TestApplyJqSchema_SingleOutputContract to cover broader/adversarial JSON shapes (scalars, nil, empty collections, mixed nested structures).
  • Keeps the invariant explicit: first iterator read must produce one non-error value; second read must be exhausted.

• Security documentation: bind values, don’t interpolate

  • Updated internal/middleware/README.md to describe both controls together:
    • $ENV disabled via WithEnvironLoader(...)
    • untrusted runtime values passed via CompileToolResponseFilterWithVars / gojq.WithVariables + RunWithContext(...) args

code, _ := CompileToolResponseFilterWithVars(
  ". + {server: $serverID, session: $sessionID}",
  []string{"$serverID", "$sessionID"},
)
iter := code.RunWithContext(ctx, data, serverID, sessionID) // values bound at runtime

• Fixes [go-fan] Go Module Review: github.com/itchyny/gojq #10606

[Copilot]

Pull request overview

Strengthens gojq safety documentation and regression coverage without changing runtime behavior.

Changes:

• Expands walk_schema single-output tests across scalar, null, empty, and nested inputs.
• Documents $ENV isolation and safe runtime variable binding.

Show a summary per file

File	Description
internal/middleware/README.md	Documents jq security controls.
internal/middleware/jqschema_test.go	Broadens single-output contract coverage.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 2/2 changed files
• Comments generated: 0
• Review effort level: Balanced

[github-actions]

🔒 mcpg Read-Only Stress — gVisor

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: gVisor (runsc) kernel-level isolation

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (issues/PRs/file/commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	unknown tool (-32602) for all 7	BLOCKED	✅
C	CLI	reads (issues/file via github bridge)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	GH_TOKEN not set — all blocked	BLOCKED	✅
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	GH_TOKEN not set — all blocked	BLOCKED	✅

Part B note: Gateway exposes only 22 read-only tools; all write tool calls return MCP error -32602 (unknown tool) — write tools absent from the gateway tool registry.

Part D/E note: gh CLI has no GH_TOKEN in this runtime; all REST and GraphQL writes fail at authentication.

Overall: PASS

References: §30827215996

🔒 mcpg read-only stress (gVisor runtime) by Read-Only Stress: gVisor runtime

[github-actions]

🔒 mcpg Read-Only Stress — default AWF

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: default AWF (normal container isolation)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (issues/PRs/file/commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	unknown tool [-32602] gateway error	BLOCKED	✅
C	CLI	reads via github CLI	data returned	ALLOWED	✅
D	CLI	REST writes via gh	auth refused (unauthenticated)	BLOCKED	✅
E	CLI	GraphQL mutations via gh	auth refused (unauthenticated)	BLOCKED	✅

Notes:

• Part B: Gateway enforces read-only via tool allow-list (22 read-only tools exposed). Write tool calls return MCP error -32602: unknown tool — this is gateway-specific enforcement, not merely backend config.
• Parts D/E: gh CLI is unauthenticated in this sandbox; all REST/GraphQL writes fail at auth layer before reaching GitHub API.

Overall: PASS

References: §30827217196

🔒 mcpg read-only stress (default AWF runtime) by Read-Only Stress: default runtime

[github-actions]

🔒 mcpg Read-Only Stress — docker-sbx

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: docker-sbx (KVM-isolated microVM)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (list_issues/list_prs/get_file/list_commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	unknown tool [-32602]	BLOCKED	✅
C	CLI	reads (list_issues/get_file via github CLI)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	GH_TOKEN not set (unauthenticated)	BLOCKED	✅
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	GH_TOKEN not set (unauthenticated)	BLOCKED	✅

Overall: PASS

Result file: RESULT=PASS RUNTIME=docker-sbx RUNID=30827216929

References: §30827216929

🔒 mcpg read-only stress (docker-sbx runtime) by Read-Only Stress: docker-sbx runtime