fix(agent): enable direct api-proxy access and remove api key from env

[Claude]

The agent container was unable to connect to api-proxy because iptables redirected all HTTP/HTTPS traffic to Squid, and ANTHROPIC_API_KEY was incorrectly exposed to the agent container instead of isolated to api-proxy.

Changes

• containers/agent/setup-iptables.sh: Add NAT RETURN rule and FILTER ACCEPT rules to bypass Squid for api-proxy traffic (ports 10000, 10001)

  • Conditional on AWF_ENABLE_API_PROXY environment variable
  • Implements correct architecture: agent → api-proxy (direct) → Squid → internet

• src/docker-manager.ts: Set AWF_ENABLE_API_PROXY='1' in agent environment when config.enableApiProxy is true

• scripts/ci/postprocess-smoke-workflows.ts: Strip ANTHROPIC_API_KEY from agent environment in compiled workflows

  • Removes security vulnerability where API key was accessible to agent
  • Key now only accessible to api-proxy sidecar

Before/After

Before: All agent HTTP/HTTPS traffic (including api-proxy) redirected to Squid

agent → iptables DNAT → Squid → api-proxy ❌

After: Agent connects directly to api-proxy, api-proxy routes through Squid

agent → api-proxy → Squid → internet ✅

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/repos/github/gh-aw-firewall/actions/runs/21975677690
  • Triggering command: /usr/bin/gh gh run view 21975677690 --repo github/gh-aw-firewall --log (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[Copilot]

Pull request overview

This PR fixes a critical security and connectivity issue with the api-proxy sidecar feature by enabling direct agent-to-api-proxy communication and removing API key exposure from the agent container.

Purpose: The agent container was unable to connect to api-proxy because iptables redirected all HTTP/HTTPS traffic through Squid, breaking the intended architecture where the agent connects directly to api-proxy. Additionally, ANTHROPIC_API_KEY was incorrectly exposed to the agent container, violating the security isolation principle where API keys should only exist in the api-proxy sidecar.

Changes:

• Added iptables NAT RETURN and FILTER ACCEPT rules to bypass Squid for api-proxy traffic (ports 10000, 10001)
• Set AWF_ENABLE_API_PROXY='1' environment variable in agent container when api-proxy is enabled
• Removed ANTHROPIC_API_KEY from agent environment in compiled Claude-based smoke test workflows

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
src/docker-manager.ts	Sets AWF_ENABLE_API_PROXY='1' environment variable in agent container when config.enableApiProxy is true, enabling iptables configuration for direct api-proxy access
containers/agent/setup-iptables.sh	Adds conditional NAT RETURN and FILTER ACCEPT rules to allow agent to connect directly to api-proxy (bypassing Squid), resolving connectivity issues while maintaining security through port restrictions
scripts/ci/postprocess-smoke-workflows.ts	Implements regex-based removal of ANTHROPIC_API_KEY from agent environment in compiled workflows, addressing security concern where API keys were accessible to agent container
.github/workflows/smoke-claude.lock.yml	Removes ANTHROPIC_API_KEY from validation and agent execution steps, as workflows use CLAUDE_CODE_OAUTH_TOKEN instead
.github/workflows/security-guard.lock.yml	Removes ANTHROPIC_API_KEY from validation and agent execution steps, consistent with OAuth token authentication approach
.github/workflows/secret-digger-claude.lock.yml	Removes ANTHROPIC_API_KEY from validation and agent execution steps, aligning with security isolation requirements

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.