Enable --enable-api-proxy for Claude and Codex engines by Mossaka · Pull Request #15533 · github/gh-aw

Mossaka · 2026-02-14T00:26:40Z

Summary

Claude engine: Add --enable-api-proxy flag to AWF args when firewall is enabled
Codex engine: Add --enable-api-proxy flag to AWF args when firewall is enabled
Docker pre-pull: Add ghcr.io/github/gh-aw-firewall/api-proxy:<version> to the download_docker_images.sh step for Claude and Codex workflows (required because --skip-pull is used)
Tests: Unit tests for docker image collection and engine flag generation
Lock files: Recompiled all workflow lock files

Context

PR #15520 attempted to enable the API proxy for Claude but the smoke-claude test failed with:

Container awf-api-proxy  Error response from daemon: No such image: ghcr.io/github/gh-aw-firewall/api-proxy:0.16.5

Root causes:

The api-proxy Docker image was not being pre-pulled in the Download container images step (the compiler's collectDockerImages() only added squid and agent images)
The --enable-api-proxy flag was only added for Claude, but the api-proxy sidecar supports both Claude (port 10001, Anthropic API) and Codex (port 10000, OpenAI API)

How the API proxy sidecar works

The AWF api-proxy is a Node.js sidecar container that:

Holds LLM API keys securely (keys are NOT exposed to the agent container)
Exposes two proxy endpoints on the Docker network:
- http://api-proxy:10000 → OpenAI API (for Codex, injects Authorization: Bearer $OPENAI_API_KEY)
- http://api-proxy:10001 → Anthropic API (for Claude, injects x-api-key: $ANTHROPIC_API_KEY)
Routes all traffic through Squid to respect domain whitelisting
Sets OPENAI_BASE_URL / ANTHROPIC_BASE_URL env vars in the agent container

Blocker

Warning

The api-proxy Docker image (ghcr.io/github/gh-aw-firewall/api-proxy) has not been published to GHCR yet. The gh-aw-firewall release workflow needs to be updated to build and push this image before smoke tests will pass. The containers/api-proxy/ directory already exists in the firewall repo.

Test plan

Unit tests pass: TestCollectDockerImages_APIProxyForClaude and TestEngineAWFEnableApiProxy
Full pkg/workflow test suite passes
Verified api-proxy image appears in smoke-claude.lock.yml and smoke-codex.lock.yml download step
Verified --enable-api-proxy flag appears in Claude and Codex AWF commands
Verified Copilot workflows do NOT include api-proxy image or flag
Smoke tests (blocked on firewall image publish)

🤖 Generated with Claude Code

…proxy image The AWF api-proxy sidecar securely holds LLM API keys and proxies requests through the firewall. It exposes two endpoints: - Port 10000: OpenAI API proxy (for Codex) - Port 10001: Anthropic API proxy (for Claude) Changes: - claude_engine.go: Add --enable-api-proxy to AWF args when firewall is enabled - codex_engine.go: Add --enable-api-proxy to AWF args when firewall is enabled - docker.go: Pre-pull ghcr.io/github/gh-aw-firewall/api-proxy image for Claude and Codex engines (required because --skip-pull is used) - Add unit tests for docker image collection and engine flag generation - Recompile all workflow lock files Fixes the smoke-claude failure where AWF tried to start the api-proxy container but the image wasn't pre-pulled: Container awf-api-proxy Error response from daemon: No such image: ghcr.io/github/gh-aw-firewall/api-proxy:0.16.5 Note: The api-proxy Docker image must also be published to GHCR via the gh-aw-firewall release workflow before smoke tests will pass. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Copilot

Pull request overview

This PR enables the AWF API proxy feature for Claude and Codex engines to securely manage LLM API keys. The API proxy is a Node.js sidecar container that holds API keys and proxies requests through the firewall, preventing key exposure to agent containers.

Changes:

Added --enable-api-proxy flag to Claude and Codex engine AWF commands when firewall is enabled
Updated Docker image collection to include api-proxy container for Claude and Codex engines
Added comprehensive unit tests for flag generation and image collection
Recompiled all workflow lock files to include api-proxy image downloads and flag usage
Minor documentation update in agent markdown file

Reviewed changes

Copilot reviewed 51 out of 51 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
pkg/workflow/docker.go	Added logic to collect api-proxy Docker image for Claude and Codex engines when firewall is enabled
pkg/workflow/claude_engine.go	Added `--enable-api-proxy` flag to AWF command with explanatory comments
pkg/workflow/codex_engine.go	Added `--enable-api-proxy` flag to AWF command with explanatory comments
pkg/workflow/enable_api_proxy_test.go	Unit tests verifying flag presence for Claude/Codex and absence for Copilot
pkg/workflow/docker_api_proxy_test.go	Unit tests verifying api-proxy image collection for Claude/Codex only
.github/workflows/*.lock.yml (43 files)	Recompiled lock files with api-proxy image and --enable-api-proxy flag
.github/agents/agentic-workflows.agent.md	Minor comment update for compile command

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

v0.17.0 includes the api-proxy container image in the release pipeline, which is required for --enable-api-proxy to work with --skip-pull. Recompiled all 150 workflow lock files to reference v0.17.0 images. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

…codex-claude

…list

github-actions · 2026-02-14T00:50:48Z

🧪 Smoke Temporary ID is now testing temporary ID functionality...

github-actions · 2026-02-14T00:50:49Z

🌑 The shadows whisper... Smoke Codex failed. The oracle requires further meditation...

github-actions · 2026-02-14T00:50:50Z

❌ Changeset Generator failed. Please review the logs for details.

github-actions · 2026-02-14T00:50:50Z

📰 BREAKING: Smoke Copilot is now investigating this pull request. Sources say the story is developing...

github-actions · 2026-02-14T00:50:55Z

🎬 THE END — Smoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨

github-actions · 2026-02-14T00:51:02Z

🧪 Smoke Project is now testing project operations...

github-actions · 2026-02-14T00:53:20Z

✅ Smoke Temporary ID completed successfully. Temporary ID validation passed.

github-actions · 2026-02-14T00:53:47Z

Agent Container Tool Check ✅

All required development tools are available in the agent container environment.

Tool	Status	Version
bash	✅	5.2.21
sh	✅	available
git	✅	2.52.0
jq	✅	1.7
yq	✅	4.52.2
curl	✅	8.5.0
gh	✅	2.86.0
node	✅	20.20.0
python3	✅	3.12.3
go	✅	1.24.13
java	✅	21.0.10
dotnet	✅	10.0.102

Result: 12/12 tools available ✅ PASS

Smoke test completed successfully - all required development tools are accessible.

AI generated by Agent Container Smoke Test

github-actions · 2026-02-14T00:54:06Z

✅ Smoke Project completed successfully. All project operations validated.

github-actions · 2026-02-14T00:55:02Z

🌑 The shadows whisper... Smoke Codex failed. The oracle requires further meditation...

github-actions · 2026-02-14T00:55:11Z

🎭 The Smoke Test Agent paid a visit! 🤖✨

Just completed a full system check and wanted to say hi to the community. All systems are operational and the coffee machine is running smoothly. ☕️

Stay awesome, everyone! 🚀

AI generated by Smoke Copilot

Copilot · 2026-02-14T01:19:36Z

@pelikhan I've opened a new pull request, #15557, to work on those changes. Once the pull request is ready, I'll request review from you.

* Initial plan * Use supportsLLMGateway flag to control api-proxy image and --enable-api-proxy flag - Set Claude engine supportsLLMGateway: true - Set Codex engine supportsLLMGateway: false - Refactor docker.go to check engine's supportsLLMGateway flag instead of hardcoded engine name - Refactor claude_engine.go to conditionally add --enable-api-proxy based on supportsLLMGateway - Add same conditional logic to codex_engine.go for future LLM gateway support - Update tests to verify behavior for all engines Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> * Apply formatting to claude_engine.go --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

github-actions · 2026-02-14T01:34:22Z

❌ Smoke Temporary ID encountered failures. Check the logs for details.

github-actions · 2026-02-14T01:34:23Z

📰 DEVELOPING STORY: Smoke Copilot reports was cancelled. Our correspondents are investigating the incident...

github-actions · 2026-02-14T01:34:51Z

🧪 Smoke Temporary ID is now testing temporary ID functionality...

github-actions · 2026-02-14T01:34:51Z

📰 BREAKING: Smoke Copilot is now investigating this pull request. Sources say the story is developing...

github-actions · 2026-02-14T01:34:52Z

❌ Smoke Project encountered failures. Check the logs for details.

github-actions · 2026-02-14T01:35:00Z

✅ Changeset Generator completed successfully!

No changeset needed: documentation-only changes

github-actions · 2026-02-14T01:35:03Z

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

github-actions · 2026-02-14T01:35:09Z

🎬 THE END — Smoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨

github-actions · 2026-02-14T01:35:32Z

🧪 Smoke Project is now testing project operations...

github-actions · 2026-02-14T01:37:30Z

✅ Smoke Temporary ID completed successfully. Temporary ID validation passed.

github-actions · 2026-02-14T01:38:04Z

Agent Container Tool Check ✅

All required development tools are available in the agent container:

Tool	Status	Version
bash	✅	5.2.21
sh	✅	available
git	✅	2.52.0
jq	✅	1.7
yq	✅	4.52.2
curl	✅	8.5.0
gh	✅	2.86.0
node	✅	20.20.0
python3	✅	3.12.3
go	✅	1.24.13
java	✅	21.0.10
dotnet	✅	10.0.102

Result: 12/12 tools available ✅

Status: PASS - All tested tools are accessible and functioning correctly in the agent container environment.

AI generated by Agent Container Smoke Test

github-actions · 2026-02-14T01:39:07Z

PRs: #15557 Refactor API proxy to use supportsLLMGateway engine flag
PRs: #3277 Refactor: Extract duplicate staged mode preview rendering into shared utility
GitHub MCP: ✅
Serena MCP: ✅
Playwright: ✅
File write+read: ✅
Build: ✅
Overall: PASS

AI generated by Smoke Codex

github-actions · 2026-02-14T01:39:09Z

✅ Smoke Project completed successfully. All project operations validated.

github-actions · 2026-02-14T01:39:11Z

Smoke Test Results

Status: ✅ PASS

Test	Result
GitHub MCP	✅
Safe Inputs GH CLI	✅
Playwright	✅
File Writing	✅
Bash Tool	✅
Discussion Interaction	✅
Build gh-aw	✅
Workflow Dispatch	✅
PR Review	✅

Run: §22008679404

cc @Mossaka

AI generated by Smoke Copilot

github-actions · 2026-02-14T01:39:30Z

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

Copilot AI review requested due to automatic review settings February 14, 2026 00:26

Copilot started reviewing on behalf of Mossaka February 14, 2026 00:27 View session

Copilot AI reviewed Feb 14, 2026

View reviewed changes

Mossaka mentioned this pull request Feb 14, 2026

feat(ci): add api-proxy image to release pipeline github/gh-aw-firewall#846

Merged

2 tasks

pelikhan added the smoke label Feb 14, 2026

Mossaka added smoke and removed smoke labels Feb 14, 2026

pelikhan added 3 commits February 14, 2026 00:49

Merge remote-tracking branch 'origin/main' into fix/enable-api-proxy-…

f373894

…codex-claude

Update frontmatter hash and correct GitHub domain in allowed domains …

7f54e50

…list

Merge branch 'main' into fix/enable-api-proxy-codex-claude

fffc98c

pelikhan added smoke and removed smoke labels Feb 14, 2026

github-actions bot mentioned this pull request Feb 14, 2026

Smoke Test: Copilot - 22007954769 #15547

Closed

Copilot AI mentioned this pull request Feb 14, 2026

Refactor API proxy to use supportsLLMGateway engine flag #15557

Merged

pelikhan added smoke labels Feb 14, 2026

This was referenced Feb 14, 2026

[smoke-temporary-id] Test Parent: Temporary ID Validation #15560

Closed

[smoke-temporary-id] Sub-Issue 2: Test Different ID Length #15561

Closed

[smoke-temporary-id] Sub-Issue 1: Test Temporary ID References #15562

Closed

github-actions bot removed the smoke label Feb 14, 2026

github-actions bot mentioned this pull request Feb 14, 2026

Smoke Test: Copilot - 22008679404 #15563

Closed

Merge branch 'main' into fix/enable-api-proxy-codex-claude

49c98f4

pelikhan merged commit fa32af8 into main Feb 14, 2026
49 of 50 checks passed

pelikhan deleted the fix/enable-api-proxy-codex-claude branch February 14, 2026 01:42

This was referenced Feb 14, 2026

Smoke Test: Claude - 22008835344 #15567

Closed

[CI Failure Doctor] Engine LLM gateway flags mismatch causing strict-mode tests to fail #15568

Closed

Conversation

Mossaka commented Feb 14, 2026

Summary

Context

How the API proxy sidecar works

Blocker

Test plan

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

github-actions bot commented Feb 14, 2026

Uh oh!

github-actions bot commented Feb 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Feb 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Feb 14, 2026

Uh oh!

github-actions bot commented Feb 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Feb 14, 2026

Uh oh!

github-actions bot commented Feb 14, 2026

Uh oh!

github-actions bot commented Feb 14, 2026

Agent Container Tool Check ✅

Uh oh!

github-actions bot commented Feb 14, 2026

Uh oh!

github-actions bot commented Feb 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Feb 14, 2026

Uh oh!

Copilot AI commented Feb 14, 2026

Uh oh!

github-actions bot commented Feb 14, 2026

Uh oh!

github-actions bot commented Feb 14, 2026

Uh oh!

github-actions bot commented Feb 14, 2026

Uh oh!

github-actions bot commented Feb 14, 2026

Uh oh!

github-actions bot commented Feb 14, 2026

Uh oh!

github-actions bot commented Feb 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Feb 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Feb 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Feb 14, 2026

Uh oh!

github-actions bot commented Feb 14, 2026

Uh oh!

github-actions bot commented Feb 14, 2026

Agent Container Tool Check ✅

Uh oh!

github-actions bot commented Feb 14, 2026

Uh oh!

github-actions bot commented Feb 14, 2026

Uh oh!

github-actions bot commented Feb 14, 2026

Smoke Test Results

Uh oh!

github-actions bot commented Feb 14, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

github-actions bot commented Feb 14, 2026 •

edited

Loading

github-actions bot commented Feb 14, 2026 •

edited

Loading

github-actions bot commented Feb 14, 2026 •

edited

Loading

github-actions bot commented Feb 14, 2026 •

edited

Loading

github-actions bot commented Feb 14, 2026 •

edited

Loading

github-actions bot commented Feb 14, 2026 •

edited

Loading

github-actions bot commented Feb 14, 2026 •

edited

Loading