feat: rename --security-mode to --legacy-security, deprecate --enable-api-proxy by lpcox · Pull Request #6209 · github/gh-aw-firewall

lpcox · 2026-07-14T00:05:33Z

Summary

Replaces the --security-mode strict|compat enum with a simple --legacy-security boolean flag and makes the API proxy unconditionally enabled.

Changes

New flag: `--legacy-security`

Boolean flag (no value needed)
Enables legacy security mode: sudo, host-access, iptables
Default (no flag) = strict security: network-isolation + API proxy

Deprecated: `--security-mode`

Still accepted for backward compatibility (hidden from --help)
--security-mode compat → maps to --legacy-security, emits deprecation warning
--security-mode strict → emits deprecation warning (strict is the default)

API proxy always enabled

--enable-api-proxy: emits deprecation warning, continues normally
--no-enable-api-proxy: hard error — API proxy cannot be disabled
API proxy is forced on in both strict and legacy modes
No real auth tokens are ever exposed to the agent container

Config file schema

security.securityMode → security.legacySecurity (boolean)

Motivation

"compat" was ambiguous — "legacy" makes it clear this is a deprecated path
No "mode" concept — just a flag you enable or don't
API proxy is a security invariant, not a choice

Closes #6207

…-api-proxy Replace the --security-mode strict|compat enum with a simple --legacy-security boolean flag. Strict security is the default and requires no flag. Legacy mode must be explicitly opted into via --legacy-security. Key changes: - Add --legacy-security boolean flag (new primary interface) - Keep --security-mode hidden for backward compatibility (emits deprecation warning) - --enable-api-proxy: emit deprecation warning (API proxy is always enabled) - --no-enable-api-proxy: hard error (API proxy cannot be disabled) - API proxy is always forced on in both strict and legacy modes - All warning messages updated to reference --legacy-security The API proxy is now unconditionally enabled for credential isolation — no real auth tokens (GITHUB_TOKEN, OPENAI_API_KEY, ANTHROPIC_API_KEY, COPILOT_GITHUB_TOKEN) are ever exposed to the agent container. Closes #6207 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 8dcc99fc-3d0e-40c5-8b75-bc43d9bf5dee

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 8dcc99fc-3d0e-40c5-8b75-bc43d9bf5dee

github-actions · 2026-07-14T00:08:00Z

⚠️ Coverage Regression Detected

This PR decreases test coverage. Please add tests to maintain coverage levels.

Overall Coverage

Metric	Base	PR	Delta
Lines	98.93%	98.86%	📉 -0.07%
Statements	98.88%	98.82%	📉 -0.06%
Functions	99.34%	99.34%	➡️ +0.00%
Branches	95.15%	95.04%	📉 -0.11%

📁 Per-file Coverage Changes (3 files)

File	Lines (Before → After)	Statements (Before → After)
`src/commands/build-config.ts`	95.7% → 84.8% (-10.81%)	95.7% → 84.8% (-10.81%)
`src/commands/validators/infrastructure-validator.ts`	100.0% → 96.6% (-3.39%)	100.0% → 96.6% (-3.39%)
`src/log-directory-setup.ts`	96.2% → 100.0% (+3.78%)	96.3% → 100.0% (+3.71%)

Coverage comparison generated by scripts/ci/compare-coverage.ts

github-actions · 2026-07-14T00:08:52Z

⚠️ Coverage Regression Detected

This PR decreases test coverage. Please add tests to maintain coverage levels.

Overall Coverage

Metric	Base	PR	Delta
Lines	98.93%	98.86%	📉 -0.07%
Statements	98.88%	98.82%	📉 -0.06%
Functions	99.34%	99.34%	➡️ +0.00%
Branches	95.15%	95.04%	📉 -0.11%

📁 Per-file Coverage Changes (3 files)

File	Lines (Before → After)	Statements (Before → After)
`src/commands/build-config.ts`	95.7% → 84.8% (-10.81%)	95.7% → 84.8% (-10.81%)
`src/commands/validators/infrastructure-validator.ts`	100.0% → 96.6% (-3.39%)	100.0% → 96.6% (-3.39%)
`src/log-directory-setup.ts`	96.2% → 100.0% (+3.78%)	96.3% → 100.0% (+3.71%)

Coverage comparison generated by scripts/ci/compare-coverage.ts

Copilot

Pull request overview

Replaces security modes with --legacy-security and makes API-proxy credential isolation mandatory.

Changes:

Adds the legacy-security flag and deprecated CLI compatibility paths.
Forces API proxy activation across security configurations.
Updates configuration types, mapping, validation tests, and integration fixtures.

Show a summary per file

File	Description
`tests/fixtures/awf-runner.ts`	Uses the new legacy flag.
`src/types/security-options.ts`	Replaces the security-mode type.
`src/config-mapper.ts`	Maps the new config property.
`src/config-file.ts`	Updates the config interface.
`src/commands/validators/security-mode.ts`	Enforces security defaults and deprecations.
`src/commands/validators/security-mode.test.ts`	Tests updated enforcement behavior.
`src/commands/validators/config-assembly.test-utils.ts`	Updates test defaults and mocks.
`src/commands/validators/config-assembly-api-proxy.test.ts`	Reflects mandatory API proxy behavior.
`src/commands/validate-options.test.ts`	Updates validation fixtures.
`src/commands/build-config.ts`	Resolves new and deprecated options.
`src/cli-options.ts`	Registers the new and compatibility flags.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 11/11 changed files
Comments generated: 5
Review effort level: Medium

  };
  security?: {
-    securityMode?: 'strict' | 'compat';
+    legacySecurity?: boolean;


+function handleApiProxyDeprecation(config: WrapperConfig): void {
+  if (config.enableApiProxy === false) {


+  if (config.enableApiProxy === false) {
+    throw new Error(
+      '--no-enable-api-proxy is not allowed. The API proxy is always enabled for credential isolation.\n' +
+      'Remove the --no-enable-api-proxy flag from your command.',
+    );


  .option(
    '--enable-api-proxy',
-    'Enable API proxy sidecar for secure credential injection.\n' +
-    '                                       Supports OpenAI (Codex) and Anthropic (Claude) APIs.'
+    '[DEPRECATED] The API proxy is always enabled. This flag is ignored.'


+  // Handle deprecated --security-mode flag
+  const securityMode = options.securityMode as string | undefined;
+  if (securityMode === 'compat') {


Tests the deprecated --security-mode compat/strict mapping and the new --legacy-security boolean flag to restore coverage above baseline. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 8dcc99fc-3d0e-40c5-8b75-bc43d9bf5dee

github-actions · 2026-07-14T00:11:58Z

✅ Copilot review passed with no inline comments.

@lpcox Add the ready-for-aw label to this PR to trigger agentic CI smoke tests.

github-actions · 2026-07-14T00:14:16Z

⚠️ Coverage Regression Detected

This PR decreases test coverage. Please add tests to maintain coverage levels.

Overall Coverage

Metric	Base	PR	Delta
Lines	98.93%	98.93%	➡️ +0.00%
Statements	98.88%	98.89%	📈 +0.01%
Functions	99.34%	99.34%	➡️ +0.00%
Branches	95.15%	95.10%	📉 -0.05%

📁 Per-file Coverage Changes (3 files)

File	Lines (Before → After)	Statements (Before → After)
`src/commands/validators/infrastructure-validator.ts`	100.0% → 96.6% (-3.39%)	100.0% → 96.6% (-3.39%)
`src/commands/build-config.ts`	95.7% → 97.0% (+1.31%)	95.7% → 97.0% (+1.31%)
`src/log-directory-setup.ts`	96.2% → 100.0% (+3.78%)	96.3% → 100.0% (+3.71%)

Coverage comparison generated by scripts/ci/compare-coverage.ts

- Update awf-config-schema.json: add legacySecurity field, keep securityMode as deprecated for backward compat - Stop mapping apiProxy.enabled from config file to avoid false CLI deprecation warnings (API proxy is unconditionally enabled) - Replace throw with logger.error + process.exit(1) for proper error reporting through the CLI validation path - Hide --enable-api-proxy and --no-enable-api-proxy from --help output - Fix resolveLegacySecurity priority: --legacy-security now wins over deprecated --security-mode when both are specified - Add config-mapper tests for securityMode → legacySecurity mapping - Move API Proxy help section header to first visible option Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 8dcc99fc-3d0e-40c5-8b75-bc43d9bf5dee

github-actions · 2026-07-14T00:20:05Z

Documentation Preview

Documentation build failed for this PR. View logs.

Built from commit fa702f5

github-actions · 2026-07-14T00:22:08Z

⚠️ Coverage Regression Detected

This PR decreases test coverage. Please add tests to maintain coverage levels.

Overall Coverage

Metric	Base	PR	Delta
Lines	98.93%	98.93%	➡️ +0.00%
Statements	98.88%	98.89%	📈 +0.01%
Functions	99.34%	99.34%	➡️ +0.00%
Branches	95.15%	95.08%	📉 -0.07%

📁 Per-file Coverage Changes (3 files)

File	Lines (Before → After)	Statements (Before → After)
`src/commands/validators/infrastructure-validator.ts`	100.0% → 96.6% (-3.39%)	100.0% → 96.6% (-3.39%)
`src/commands/build-config.ts`	95.7% → 97.1% (+1.49%)	95.7% → 97.1% (+1.49%)
`src/log-directory-setup.ts`	96.2% → 100.0% (+3.78%)	96.3% → 100.0% (+3.71%)

Coverage comparison generated by scripts/ci/compare-coverage.ts

…tion path Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 8dcc99fc-3d0e-40c5-8b75-bc43d9bf5dee

github-actions · 2026-07-14T00:23:26Z

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

github-actions · 2026-07-14T00:23:27Z

🔌 Smoke Services — All services reachable! ✅

github-actions · 2026-07-14T00:23:27Z

✅ Smoke Claude passed

github-actions · 2026-07-14T00:23:28Z

📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅

github-actions · 2026-07-14T00:23:28Z

Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded.

github-actions · 2026-07-14T00:23:29Z

✅ Build Test Suite completed successfully!

github-actions · 2026-07-14T00:23:29Z

✅ Smoke Copilot BYOK AOAI (Entra) completed. Copilot AOAI BYOK (Entra) mode operational. 🔓

Tests failed; no label added

github-actions · 2026-07-14T00:23:30Z

🔑 Smoke Copilot PAT PAT auth validated. All systems operational. ✅

github-actions · 2026-07-14T00:23:30Z

✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓

github-actions · 2026-07-14T00:23:32Z

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

github-actions · 2026-07-14T00:23:32Z

✅ Smoke Copilot BYOK AOAI (api-key) completed. Copilot AOAI BYOK (api-key) mode operational. 🔓

github-actions · 2026-07-14T00:23:32Z

❌ Contribution Check failed. Please review the logs for details.

github-actions · 2026-07-14T00:23:34Z

🚀 Security Guard has started processing this pull request

github-actions · 2026-07-14T00:23:36Z

✅ Smoke Gemini completed. All facets verified. 💎

github-actions · 2026-07-14T00:23:52Z

📰 VERDICT: Smoke Docker Sbx has concluded. All systems operational. This is a developing story. 🎤

github-actions · 2026-07-14T00:24:50Z

⚠️ Coverage Regression Detected

This PR decreases test coverage. Please add tests to maintain coverage levels.

Overall Coverage

Metric	Base	PR	Delta
Lines	98.93%	98.96%	📈 +0.03%
Statements	98.88%	98.92%	📈 +0.04%
Functions	99.34%	99.34%	➡️ +0.00%
Branches	95.15%	95.11%	📉 -0.04%

📁 Per-file Coverage Changes (2 files)

File	Lines (Before → After)	Statements (Before → After)
`src/commands/build-config.ts`	95.7% → 97.1% (+1.49%)	95.7% → 97.1% (+1.49%)
`src/log-directory-setup.ts`	96.2% → 100.0% (+3.78%)	96.3% → 100.0% (+3.71%)

Coverage comparison generated by scripts/ci/compare-coverage.ts

github-actions · 2026-07-14T00:27:57Z

Smoke Test Results

Test	Result
GitHub MCP connectivity	✅ (available)
GitHub.com HTTP	❌ (pre-step template vars not expanded)
File write/read	❌ (pre-step template vars not expanded)

Overall: FAIL — pre-computed step outputs were not injected into prompt.

PR author: @lpcox

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

📰 BREAKING: Report filed by Smoke Copilot
_{Add label ready-for-aw to run again}

github-actions · 2026-07-14T00:27:59Z

Smoke Test: Copilot BYOK (Direct) Mode

Test	Result
GitHub.com Connectivity	✅ HTTP 200
File Write/Read	✅
BYOK Inference	✅
MCP Connectivity	⚠️ (gh not authenticated in sandbox)

Status: PASS (core BYOK path working)

Running in direct BYOK mode via api-proxy → api.githubcopilot.com

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🔑 BYOK report filed by Smoke Copilot BYOK
_{Add label ready-for-aw to run again}

github-actions · 2026-07-14T00:28:02Z

Smoke Test: Copilot PAT Auth

Test	Result
GitHub MCP connectivity	✅
GitHub.com HTTP	⚠️ pre-step data unavailable (template vars unexpanded)
File write/read	⚠️ pre-step data unavailable (template vars unexpanded)

Overall: PARTIAL — MCP reachable; pre-computed outputs not expanded.

Auth mode: PAT (COPILOT_GITHUB_TOKEN) | Author: @lpcox

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🔑 PAT report filed by Smoke Copilot PAT
_{Add label ready-for-aw to run again}

github-actions · 2026-07-14T00:28:12Z

Smoke Test: Claude Engine Validation

Overall result: ✅ PASS

Check	Result
API status	✅ PASS
gh check	✅ PASS
File status	✅ PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by Smoke Claude for #6209 · 55.1 AIC · ⊞ 5.8K · ◷
_{Add label ready-for-aw to run again}

github-actions · 2026-07-14T00:28:53Z

Smoke Test Results

PR titles:
1. feat: add --security-mode strict|compat with strict as default (feat: add --security-mode strict|compat with strict as default #6197)
2. [Unknown - could not list PRs]
GitHub MCP Testing: ❌
GitHub.com Connectivity: ❌
File Writing Testing: ✅
Bash Tool Testing: ✅

Overall status: FAIL

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

localhost

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "localhost"

See Network Configuration for more information.

💎 Faceted by Smoke Gemini
_{Add label ready-for-aw to run again}

github-actions · 2026-07-14T00:29:00Z

Smoke test results:\n- feat: add --security-mode strict|compat with strict as default ✅\n- feat: rename --security-mode to --legacy-security, deprecate --enable-api-proxy ✅\n- GitHub title check ✅\n- Discussion lookup/comment ✅\n- File write/read ✅\n- Build ✅\nOverall status: PASS

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

awmgmcpg
registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

github-actions · 2026-07-14T00:29:16Z

🔬 Smoke Test: API Proxy OpenTelemetry Tracing

Scenario	Result	Notes
1. Module Loading	✅ Pass	`otel.js` loads successfully; exports: `startRequestSpan`, `setTokenAttributes`, `setBudgetAttributes`, `endSpan`, `endSpanError`, `shutdown`, `isEnabled`
2. Test Suite	✅ Pass	59 tests passed across `otel.test.js` + `otel-fanout.test.js` (0 failures)
3. Env Var Forwarding	✅ Pass	`api-proxy-env-config.ts` forwards `GH_AW_OTLP_ENDPOINTS`, `OTEL_EXPORTER_OTLP_ENDPOINT`, `OTEL_EXPORTER_OTLP_HEADERS`, `GITHUB_AW_OTEL_TRACE_ID`, `GITHUB_AW_OTEL_PARENT_SPAN_ID`, `OTEL_SERVICE_NAME`
4. Token Tracker Integration	✅ Pass	`onUsage` callback exists in `token-tracker-http.js` as the OTEL hook point
5. OTEL Diagnostics	⏳ Pending	Post-agent step; agent job still in progress at report time

Overall: All pre-step validations passed. OTEL tracing integration is functional.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

📡 OTel tracing validated by Smoke OTel Tracing
_{Add label ready-for-aw to run again}

github-actions · 2026-07-14T00:29:25Z

Smoke Test: Services Connectivity

Redis PING: ❌ (host.docker.internal DNS does not resolve; fallback to 127.0.0.1 → Connection refused)
PostgreSQL pg_isready: ❌ (no response on port 5432)
PostgreSQL SELECT 1: ❌ (connection refused)

Overall: FAIL — service containers are not reachable from this runner environment (host.docker.internal DNS unavailable, no default gateway detected).

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🔌 Service connectivity validated by Smoke Services
_{Add label ready-for-aw to run again}

github-actions · 2026-07-14T00:29:34Z

Chroot Version Comparison

Runtime	Host Version	Chroot Version	Match?
Python	Python 3.12.13	Python 3.12.3	❌
Node.js	v24.18.0	v22.23.1	❌
Go	go1.22.12	go1.22.12	✅

Result: Not all tests passed — Python and Node.js versions differ between host and chroot.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Tested by Smoke Chroot
_{Add label ready-for-aw to run again}

github-actions · 2026-07-14T00:29:39Z

Smoke Test: Copilot BYOK (Direct) Mode — Azure OpenAI (Foundry, api-key)

GitHub MCP Testing: ✅
GitHub.com Connectivity: ✅
File Write/Read Test: ✅
BYOK Inference Test: ✅

Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (Foundry, o4-mini-aw)

Overall: PASS

CC: @lpcox

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🔑 BYOK (AOAI api-key) report filed by Smoke Copilot BYOK AOAI (api-key)
_{Add label ready-for-aw to run again}

github-actions · 2026-07-14T00:30:27Z

🔥 Smoke Test: Docker Sbx — PASS

Test	Result
GitHub MCP connectivity	✅
github.com HTTP (200)	✅
File write/read	✅

PR: feat: rename --security-mode to --legacy-security, deprecate --enable-api-proxy
Author: @lpcox

Overall: PASS

📰 BREAKING: Report filed by Smoke Docker Sbx
_{Add label ready-for-aw to run again}

github-actions · 2026-07-14T00:30:36Z

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A	✅ PASS
.NET	json-parse	✅	N/A	✅ PASS
Go	color	✅	all passed	✅ PASS
Go	env	✅	all passed	✅ PASS
Go	uuid	✅	all passed	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	all passed	✅ PASS
Node.js	execa	✅	all passed	✅ PASS
Node.js	p-limit	✅	all passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — ✅ PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by Build Test Suite for #6209 · 56.6 AIC · ⊞ 6.9K · ◷
_{Add label ready-for-aw to run again}

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 8dcc99fc-3d0e-40c5-8b75-bc43d9bf5dee

github-actions · 2026-07-14T00:32:19Z

test from agent

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🪪 BYOK (AOAI Entra) report filed by Smoke Copilot BYOK AOAI (Entra)
_{Add label ready-for-aw to run again}

github-actions · 2026-07-14T00:33:48Z

⚠️ Coverage Regression Detected

This PR decreases test coverage. Please add tests to maintain coverage levels.

Overall Coverage

Metric	Base	PR	Delta
Lines	98.93%	98.96%	📈 +0.03%
Statements	98.88%	98.92%	📈 +0.04%
Functions	99.34%	99.34%	➡️ +0.00%
Branches	95.15%	95.14%	📉 -0.01%

📁 Per-file Coverage Changes (2 files)

File	Lines (Before → After)	Statements (Before → After)
`src/commands/build-config.ts`	95.7% → 97.1% (+1.49%)	95.7% → 97.1% (+1.49%)
`src/log-directory-setup.ts`	96.2% → 100.0% (+3.78%)	96.3% → 100.0% (+3.71%)

Coverage comparison generated by scripts/ci/compare-coverage.ts

Cover the AWF_DEBUG_TOKENS env var branch in build-config to push overall branch coverage above the base threshold. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 8dcc99fc-3d0e-40c5-8b75-bc43d9bf5dee

github-actions · 2026-07-14T00:46:58Z

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	98.93%	98.96%	📈 +0.03%
Statements	98.88%	98.92%	📈 +0.04%
Functions	99.34%	99.34%	➡️ +0.00%
Branches	95.15%	95.16%	➡️ +0.01%

📁 Per-file Coverage Changes (2 files)

File	Lines (Before → After)	Statements (Before → After)
`src/commands/build-config.ts`	95.7% → 97.1% (+1.49%)	95.7% → 97.1% (+1.49%)
`src/log-directory-setup.ts`	96.2% → 100.0% (+3.78%)	96.3% → 100.0% (+3.71%)

Coverage comparison generated by scripts/ci/compare-coverage.ts

Copilot AI review requested due to automatic review settings July 14, 2026 00:05

Copilot started reviewing on behalf of lpcox July 14, 2026 00:05 View session

fix: remove unused validateRateLimitFlags import

49ef658

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 8dcc99fc-3d0e-40c5-8b75-bc43d9bf5dee

Copilot AI reviewed Jul 14, 2026

View reviewed changes

test: restore infrastructure-validator coverage for rate limit valida…

abe200f

…tion path Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 8dcc99fc-3d0e-40c5-8b75-bc43d9bf5dee

lpcox added the ready-for-aw label Jul 14, 2026

lpcox temporarily deployed to aoai-model July 14, 2026 00:23 — with GitHub Actions Inactive

github-actions Bot added the smoke-copilot-byok label Jul 14, 2026

github-actions Bot added the smoke-claude label Jul 14, 2026

github-actions Bot added the smoke-codex label Jul 14, 2026

github-actions Bot added the smoke-copilot-byok-aoai-apikey label Jul 14, 2026

github-actions Bot added the smoke-docker-sbx label Jul 14, 2026

github-actions Bot added the build-test label Jul 14, 2026

test: cover legacySecurity=false branch in resolveLegacySecurity

0a7291d

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 8dcc99fc-3d0e-40c5-8b75-bc43d9bf5dee

github-actions Bot mentioned this pull request Jul 14, 2026

[aw] Contribution Check failed #6210

Open

lpcox merged commit 18817f9 into main Jul 14, 2026
24 checks passed

lpcox deleted the feat/legacy-security-rename branch July 14, 2026 01:03

lpcox mentioned this pull request Jul 14, 2026

feat: default to strict security mode, stop injecting sudo and --enable-host-access github/gh-aw#45360

Open

		function handleApiProxyDeprecation(config: WrapperConfig): void {
		if (config.enableApiProxy === false) {

Uh oh!

Conversation

lpcox commented Jul 14, 2026

Summary

Changes

New flag: --legacy-security

Deprecated: --security-mode

API proxy always enabled

Config file schema

Motivation

Closes #6207

Related

Uh oh!

github-actions Bot commented Jul 14, 2026

⚠️ Coverage Regression Detected

Overall Coverage

Uh oh!

github-actions Bot commented Jul 14, 2026

⚠️ Coverage Regression Detected

Overall Coverage

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

github-actions Bot commented Jul 14, 2026

Uh oh!

github-actions Bot commented Jul 14, 2026

⚠️ Coverage Regression Detected

Overall Coverage

Uh oh!

github-actions Bot commented Jul 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Documentation Preview

Uh oh!

github-actions Bot commented Jul 14, 2026

⚠️ Coverage Regression Detected

Overall Coverage

Uh oh!

github-actions Bot commented Jul 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 14, 2026

Uh oh!

github-actions Bot commented Jul 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

New flag: `--legacy-security`

Deprecated: `--security-mode`

github-actions Bot commented Jul 14, 2026 •

edited

Loading

github-actions Bot commented Jul 14, 2026 •

edited

Loading

github-actions Bot commented Jul 14, 2026 •

edited

Loading

github-actions Bot commented Jul 14, 2026 •

edited

Loading

github-actions Bot commented Jul 14, 2026 •

edited

Loading

github-actions Bot commented Jul 14, 2026 •

edited

Loading

github-actions Bot commented Jul 14, 2026 •

edited

Loading

github-actions Bot commented Jul 14, 2026 •

edited

Loading

github-actions Bot commented Jul 14, 2026 •

edited

Loading

github-actions Bot commented Jul 14, 2026 •

edited

Loading

github-actions Bot commented Jul 14, 2026 •

edited

Loading

github-actions Bot commented Jul 14, 2026 •

edited

Loading

github-actions Bot commented Jul 14, 2026 •

edited

Loading

github-actions Bot commented Jul 14, 2026 •

edited

Loading

github-actions Bot commented Jul 14, 2026 •

edited

Loading