fix: capture Copilot CLI session state (events.jsonl) in AWF sandbox artifacts by Copilot · Pull Request #1945 · github/gh-aw-firewall

Copilot · 2026-04-12T18:59:55Z

When Copilot CLI runs inside the AWF Docker container, events.jsonl is written to $HOME/.copilot/session-state inside the container. The compiled workflow's "Copy Copilot session state" step called copy_copilot_session_state.sh, which reads from the host runner's $HOME/.copilot/session-state — always empty in this case — so events.jsonl never made it into the artifact.

Changes

`scripts/ci/postprocess-smoke-workflows.ts`

Two new idempotent transformations applied to all lock files:

--session-state-dir injection — anchors to --audit-dir /tmp/gh-aw/sandbox/firewall/audit (present in every compiled lock file) and appends --session-state-dir /tmp/gh-aw/sandbox/agent/session-state. AWF bind-mounts this host path into the container at $HOME/.copilot/session-state, so the CLI writes session state directly to a host-accessible path.
Copy step replacement — replaces the copy_copilot_session_state.sh call with an inline script that copies from the AWF-managed path into the agent logs directory (/tmp/gh-aw/sandbox/agent/logs/session-state/), which is already included in the artifact upload.

# Before
- name: Copy Copilot session state files to logs
  if: always()
  continue-on-error: true
  run: bash "${RUNNER_TEMP}/gh-aw/actions/copy_copilot_session_state.sh"

# After
- name: Copy Copilot session state files to logs
  if: always()
  continue-on-error: true
  run: |
    SESSION_STATE_SRC="/tmp/gh-aw/sandbox/agent/session-state"
    LOGS_DIR="/tmp/gh-aw/sandbox/agent/logs"
    if [ -d "$SESSION_STATE_SRC" ] && [ -n "$(ls -A "$SESSION_STATE_SRC" 2>/dev/null)" ]; then
      mkdir -p "$LOGS_DIR/session-state"
      cp -rp "$SESSION_STATE_SRC/." "$LOGS_DIR/session-state/"
      echo "Copied session state to $LOGS_DIR/session-state"
    else
      echo "No session state found at $SESSION_STATE_SRC"
    fi

`scripts/ci/postprocess-smoke-workflows.test.ts`

Unit tests for both new regex patterns (sessionStateDirInjectionRegex, copySessionStateStepRegex) and the buildCopySessionStateStep builder, including idempotency coverage.

Lock files (27 files)

All *.lock.yml files updated by running the post-process script.

Add --session-state-dir to AWF invocations and replace the copy_copilot_session_state.sh step with an inline script that reads from the AWF-managed host path instead of $HOME/.copilot/ session-state (which is empty when CLI ran inside the container). Agent-Logs-Url: https://github.com/github/gh-aw-firewall/sessions/6833d315-fdff-4cf9-b5a6-7e322a307397

Copilot

Pull request overview

This PR ensures Copilot CLI session state (events.jsonl) generated inside the AWF Docker sandbox is written to a host-accessible directory and included in existing workflow artifacts.

Changes:

Post-process all *.lock.yml workflows to inject --session-state-dir /tmp/gh-aw/sandbox/agent/session-state into AWF invocations (idempotently).
Replace the compiler-generated “Copy Copilot session state” step with an inline copy script that reads from the AWF-managed session-state directory and copies into the existing agent logs artifact path.
Add unit tests covering the new regex transforms and the replacement-step builder, including idempotency checks.

Show a summary per file

File	Description
scripts/ci/postprocess-smoke-workflows.ts	Adds two post-processing transforms: inject `--session-state-dir` and replace the session-state copy step with an AWF-aware inline script.
scripts/ci/postprocess-smoke-workflows.test.ts	Adds unit tests for the new regexes and the step builder, including idempotency coverage.
.github/workflows/build-test.lock.yml	Applies injected `--session-state-dir` and replaces session-state copy step to capture session state in artifacts.
.github/workflows/ci-cd-gaps-assessment.lock.yml	Applies injected `--session-state-dir` and replaces session-state copy step to capture session state in artifacts.
.github/workflows/ci-doctor.lock.yml	Applies injected `--session-state-dir` and replaces session-state copy step to capture session state in artifacts.
.github/workflows/claude-token-optimizer.lock.yml	Applies injected `--session-state-dir` and replaces session-state copy step (no-op if no session state) for consistent artifact behavior.
.github/workflows/claude-token-usage-analyzer.lock.yml	Applies injected `--session-state-dir` and replaces session-state copy step (no-op if no session state) for consistent artifact behavior.
.github/workflows/cli-flag-consistency-checker.lock.yml	Applies injected `--session-state-dir` and replaces session-state copy step to capture session state in artifacts.
.github/workflows/copilot-token-optimizer.lock.yml	Applies injected `--session-state-dir` and replaces session-state copy step to capture session state in artifacts.
.github/workflows/copilot-token-usage-analyzer.lock.yml	Applies injected `--session-state-dir` and replaces session-state copy step to capture session state in artifacts.
.github/workflows/dependency-security-monitor.lock.yml	Applies injected `--session-state-dir` and replaces session-state copy step to capture session state in artifacts.
.github/workflows/doc-maintainer.lock.yml	Applies injected `--session-state-dir` and replaces session-state copy step to capture session state in artifacts.
.github/workflows/firewall-issue-dispatcher.lock.yml	Applies injected `--session-state-dir` and replaces session-state copy step to capture session state in artifacts.
.github/workflows/issue-duplication-detector.lock.yml	Applies injected `--session-state-dir` and replaces session-state copy step to capture session state in artifacts.
.github/workflows/issue-monster.lock.yml	Applies injected `--session-state-dir` and replaces session-state copy step to capture session state in artifacts.
.github/workflows/pelis-agent-factory-advisor.lock.yml	Applies injected `--session-state-dir` and replaces session-state copy step to capture session state in artifacts.
.github/workflows/plan.lock.yml	Applies injected `--session-state-dir` and replaces session-state copy step to capture session state in artifacts.
.github/workflows/secret-digger-claude.lock.yml	Applies injected `--session-state-dir` and replaces session-state copy step (no-op if no session state) for consistent artifact behavior.
.github/workflows/secret-digger-codex.lock.yml	Applies injected `--session-state-dir` and replaces session-state copy step (no-op if no session state) for consistent artifact behavior.
.github/workflows/secret-digger-copilot.lock.yml	Applies injected `--session-state-dir` and replaces session-state copy step to capture session state in artifacts (including multi-invocation workflows).
.github/workflows/security-guard.lock.yml	Applies injected `--session-state-dir` and replaces session-state copy step (no-op if no session state) for consistent artifact behavior.
.github/workflows/security-review.lock.yml	Applies injected `--session-state-dir` and replaces session-state copy step to capture session state in artifacts.
.github/workflows/smoke-chroot.lock.yml	Applies injected `--session-state-dir` and replaces session-state copy step to capture session state in artifacts.
.github/workflows/smoke-claude.lock.yml	Applies injected `--session-state-dir` and replaces session-state copy step (no-op if no session state) for consistent artifact behavior.
.github/workflows/smoke-codex.lock.yml	Applies injected `--session-state-dir` and replaces session-state copy step (no-op if no session state) for consistent artifact behavior.
.github/workflows/smoke-copilot.lock.yml	Applies injected `--session-state-dir` and replaces session-state copy step to capture session state in artifacts.
.github/workflows/smoke-services.lock.yml	Applies injected `--session-state-dir` and replaces session-state copy step to capture session state in artifacts.
.github/workflows/test-coverage-improver.lock.yml	Applies injected `--session-state-dir` and replaces session-state copy step to capture session state in artifacts.
.github/workflows/update-release-notes.lock.yml	Applies injected `--session-state-dir` and replaces session-state copy step to capture session state in artifacts.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 29/29 changed files
Comments generated: 0

github-actions · 2026-04-12T20:13:03Z

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	85.31%	85.40%	📈 +0.09%
Statements	85.17%	85.25%	📈 +0.08%
Functions	87.50%	87.50%	➡️ +0.00%
Branches	77.58%	77.63%	📈 +0.05%

📁 Per-file Coverage Changes (1 files)

File	Lines (Before → After)	Statements (Before → After)
`src/docker-manager.ts`	86.1% → 86.4% (+0.32%)	85.7% → 86.0% (+0.31%)

Coverage comparison generated by scripts/ci/compare-coverage.ts

github-actions · 2026-04-12T20:15:27Z

Smoke Test Results

✅ GitHub MCP: fix: always route Gemini through api-proxy sidecar when --enable-api-proxy is active (#1946), feat: collect diagnostic logs on container startup failure (#1941)
✅ Playwright: GitHub page title verified
✅ File Write: /tmp/gh-aw/agent/smoke-test-claude-24314442127.txt created and read back
✅ Bash: File contents confirmed

Overall: PASS

💥 [THE END] — Illustrated by Smoke Claude

github-actions · 2026-04-12T20:15:48Z

🔥 AWF Smoke Test Results

Test	Status
GitHub MCP (`list_pull_requests`)	✅
GitHub.com connectivity (HTTP 200)	✅
File write/read	✅

Overall: PASS

PR: fix: capture Copilot CLI session state (events.jsonl) in AWF sandbox artifacts
Author: @app/copilot-swe-agent · Assignees: @lpcox, @Copilot

📰 BREAKING: Report filed by Smoke Copilot

github-actions · 2026-04-12T20:16:03Z

Smoke Test: GitHub Actions Services Connectivity ✅

All connectivity checks passed:

Service	Check	Result
Redis `host.docker.internal:6379`	PING	✅ `PONG`
PostgreSQL `host.docker.internal:5432`	`pg_isready`	✅ accepting connections
PostgreSQL `smoketest` DB	`SELECT 1`	✅ returned `1`

Note: redis-cli was not pre-installed; Redis was verified via raw TCP socket (Python), which returned +PONG.

🔌 Service connectivity validated by Smoke Services

github-actions · 2026-04-12T20:16:05Z

Smoke Test (Codex)

Merged PR titles: "fix: always route Gemini through api-proxy sidecar when --enable-api-proxy is active"; "feat: collect diagnostic logs on container startup failure" ✅
safeinputs-gh PR query (2 PRs) ❌
Playwright github.com title contains "GitHub" ✅
Tavily search returned >=1 result ❌
File write + bash cat check ✅
Discussion query + mystical comment ❌
npm ci && npm run build ✅
Overall status: FAIL

🔮 The oracle has spoken through Smoke Codex

lpcox · 2026-04-12T20:16:43Z

@copilot resolve the merge conflicts in this pull request

github-actions · 2026-04-12T20:18:06Z

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A	✅ PASS
.NET	json-parse	✅	N/A	✅ PASS
Go	color	✅	1/1 passed	✅ PASS
Go	env	✅	1/1 passed	✅ PASS
Go	uuid	✅	1/1 passed	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	All passed	✅ PASS
Node.js	execa	✅	All passed	✅ PASS
Node.js	p-limit	✅	All passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — ✅ PASS

Generated by Build Test Suite for issue #1945 · ● 678.1K · ◷

Agent-Logs-Url: https://github.com/github/gh-aw-firewall/sessions/d5c1499d-ca46-4260-9a15-4f8ad5f1b306

Copilot · 2026-04-12T20:20:14Z

@copilot resolve the merge conflicts in this pull request

Resolved. The only conflict was in security-guard.lock.yml — main had updated it with --max-turns 8 and a new GH_AW_EXPR_66EB691F env var (from #1940), while our branch had injected --session-state-dir. Merged by taking main's updated version and re-applying the postprocess transformation to inject --session-state-dir. Committed in f35f8a1.

Initial plan

8360bd8

Copilot AI assigned Copilot and lpcox Apr 12, 2026

Copilot AI linked an issue Apr 12, 2026 that may be closed by this pull request

[awf] Docker Manager: Copilot CLI events.jsonl not captured in artifact (session-state written inside container) #1932

Open

Copilot started work on behalf of lpcox April 12, 2026 19:10 View session

Copilot AI changed the title ~~[WIP] Fix Docker Manager not capturing events.jsonl in artifact~~ fix: capture Copilot CLI session state (events.jsonl) in AWF sandbox artifacts Apr 12, 2026

Copilot AI requested a review from lpcox April 12, 2026 19:22

Copilot finished work on behalf of lpcox April 12, 2026 19:22

lpcox marked this pull request as ready for review April 12, 2026 19:27

lpcox requested a review from Mossaka as a code owner April 12, 2026 19:27

Copilot AI review requested due to automatic review settings April 12, 2026 19:27

Copilot started reviewing on behalf of lpcox April 12, 2026 19:28 View session

Copilot AI reviewed Apr 12, 2026

View reviewed changes

github-actions bot added smoke-claude smoke-copilot labels Apr 12, 2026

github-actions bot added the smoke-services label Apr 12, 2026

Copilot started work on behalf of lpcox April 12, 2026 20:16 View session

github-actions bot added the build-test label Apr 12, 2026

github-actions bot mentioned this pull request Apr 12, 2026

[aw] No-Op Runs #1668

Open

chore: merge main into branch, resolve security-guard conflict

f35f8a1

Agent-Logs-Url: https://github.com/github/gh-aw-firewall/sessions/d5c1499d-ca46-4260-9a15-4f8ad5f1b306

Copilot finished work on behalf of lpcox April 12, 2026 20:20

lpcox enabled auto-merge (squash) April 12, 2026 20:24

Merge branch 'main' into copilot/fix-copilot-events-jsonl-capture

dbe3bc8

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: capture Copilot CLI session state (events.jsonl) in AWF sandbox artifacts#1945

fix: capture Copilot CLI session state (events.jsonl) in AWF sandbox artifacts#1945
Copilot wants to merge 4 commits intomainfrom
copilot/fix-copilot-events-jsonl-capture

Copilot AI commented Apr 12, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

github-actions bot commented Apr 12, 2026

Uh oh!

github-actions bot commented Apr 12, 2026

Uh oh!

github-actions bot commented Apr 12, 2026

Uh oh!

github-actions bot commented Apr 12, 2026

Uh oh!

github-actions bot commented Apr 12, 2026

Uh oh!

lpcox commented Apr 12, 2026

Uh oh!

github-actions bot commented Apr 12, 2026

Uh oh!

Copilot AI commented Apr 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

Copilot AI commented Apr 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

scripts/ci/postprocess-smoke-workflows.ts

scripts/ci/postprocess-smoke-workflows.test.ts

Lock files (27 files)

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

github-actions bot commented Apr 12, 2026

✅ Coverage Check Passed

Overall Coverage

Uh oh!

github-actions bot commented Apr 12, 2026

Smoke Test Results

Uh oh!

github-actions bot commented Apr 12, 2026

🔥 AWF Smoke Test Results

Uh oh!

github-actions bot commented Apr 12, 2026

Smoke Test: GitHub Actions Services Connectivity ✅

Uh oh!

github-actions bot commented Apr 12, 2026

Uh oh!

lpcox commented Apr 12, 2026

Uh oh!

github-actions bot commented Apr 12, 2026

🏗️ Build Test Suite Results

Uh oh!

Copilot AI commented Apr 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Apr 12, 2026 •

edited

Loading

`scripts/ci/postprocess-smoke-workflows.ts`

`scripts/ci/postprocess-smoke-workflows.test.ts`