feat: auto-inject COPILOT_PROVIDER_WIRE_API=responses for GPT-5 models in sandboxed Copilot workflows

[Copilot]

New Feature

Sandboxed engine: copilot workflows activate BYOK/offline mode via a dummy COPILOT_API_KEY, which routes all Copilot CLI traffic through the AWF api-proxy sidecar. In BYOK mode the wire API defaults to completions, but GPT-5 family models require responses — so any sandboxed workflow targeting a GPT-5 model silently fails unless the user manually sets COPILOT_PROVIDER_WIRE_API or disables the sandbox (sacrificing safe-output threat detection).

What does this feature do?

The compiler now automatically injects COPILOT_PROVIDER_WIRE_API: responses when a GPT-5 family model is statically detected and the AWF sandbox is enabled. User-supplied values in engine.env always take precedence.

Implementation details

• pkg/constants/engine_constants.go — Added CopilotProviderWireAPI ("COPILOT_PROVIDER_WIRE_API") and CopilotProviderWireAPIResponses ("responses") constants alongside the existing BYOK constants.

• pkg/workflow/copilot_engine_execution.go — Added copilotModelRequiresResponsesAPI(model string) bool helper that strips provider prefix and query params then matches gpt-5* (case-insensitive). In GetExecutionSteps, inside the if sandboxEnabled block, injects the wire API env var when the model is statically configured, GPT-5 family, and not already overridden by the user:

  if _, alreadySet := env[constants.CopilotProviderWireAPI]; !alreadySet {
      modelToCheck := ""
      if modelConfigured {
          modelToCheck = workflowData.EngineConfig.Model
      }
      if copilotModelRequiresResponsesAPI(modelToCheck) {
          env[constants.CopilotProviderWireAPI] = constants.CopilotProviderWireAPIResponses
      }
  }

  Handles bare names (gpt-5), provider-scoped names (copilot/gpt-5), and parameterized names (gpt-5?effort=high).

• pkg/workflow/copilot_engine_test.go — Added TestCopilotModelRequiresResponsesAPI (14 cases covering GPT-5 variants, non-GPT-5 models, edge cases) and TestCopilotEngineSetsWireAPIForGPT5Models (7 cases covering injection, non-injection, and user-override scenarios).

• docs/src/content/docs/reference/engines.md — Updated the BYOK variable table to document automatic injection.

Note on dynamic model expressions: For ${{ vars.MY_MODEL || 'gpt-5' }} the compiler cannot statically determine the wire API at compile time. Users targeting GPT-5 via a variable expression should set engine.env.COPILOT_PROVIDER_WIRE_API: responses explicitly.