fix: propagate config fields to all layers - #6970
Conversation
PR #6936 (feat(cli): add API proxy reflection mode) introduced the --reflect CLI flag but did not add it to the Section 5 CLI Mapping table in docs/awf-config-spec.md. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
Documents the previously omitted --reflect CLI-only configuration mapping.
Changes:
- Adds
--reflectbehavior and command exclusivity to the config specification.
Show a summary per file
| File | Description |
|---|---|
docs/awf-config-spec.md |
Documents the --reflect CLI mapping. |
Review details
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 1/1 changed files
- Comments generated: 0
- Review effort level: Balanced
|
✅ Smoke Gemini completed. All facets verified. 💎 |
|
✅ Smoke Claude passed |
|
🚀 Security Guard has started processing this pull request |
|
✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓 |
|
📰 VERDICT: Smoke Docker Sbx has concluded. All systems operational. This is a developing story. 🎤 |
|
📡 Smoke OTel Tracing reports failed. OTel tracing regression detected. Smoke Test: API Proxy OTEL Tracing — all scenarios passed. 1) Module loading: ✅ otel.js loads, isEnabled()=true, exports 15 functions (startRequestSpan, setTokenAttributes, setBudgetAttributes, endSpan, endSpanError, shutdown, isEnabled, etc). 2) Test suite: ✅ 68/68 tests passed across otel.test.js, otel-fanout.test.js, otel-workload-identity.test.js (3 suites). 3) Env var forwarding: ✅ GITHUB_AW_OTEL_TRACE_ID and GITHUB_AW_OTEL_PARENT_SPAN_ID present in env-passthrough.ts; api-proxy-env-config.ts buildOtelEnv() forwards GH_AW_OTLP_ENDPOINTS, OTEL_EXPORTER_OTLP_ENDPOINT/HEADERS, trace context, and workload identity vars. 4) Token tracker integration: ✅ onUsage callback exists in token-tracker-http.js (line 348/406) as the OTEL hook point, invoked with normalized usage + model. 5) OTEL diagnostics: not applicable in this session run (no live agent traffic generated), graceful degradation confirmed via module load without config. No regressions detected. |
|
✅ Contribution Check completed successfully! PR #6970 follows the documented contribution guidelines: the change is small, documented in docs/awf-config-spec.md, and the PR description includes the rationale and validation notes. No additional comment needed. |
|
🛡️ Smoke Copilot Network Isolation confirmed the egress allowlist is enforced. ✅ |
|
❌ Smoke Copilot BYOK AOAI (Entra) reports failed. AOAI BYOK (Entra) mode investigation needed... |
|
✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟 |
|
Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded. |
|
❌ Smoke Copilot BYOK AOAI (api-key) reports failed. AOAI BYOK (api-key) mode investigation needed... |
|
✅ Build Test Suite completed successfully! |
|
📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤 |
|
🔌 Smoke Services — All services reachable! ✅ |
Smoke Test: Claude Engine Validation
Overall result: PASS
|
|
EGRESS_RESULT allow=pass deny=pass ✅ Allowed domain (github.com) reachable: Overall: PASS — network-isolation egress enforcement working as expected. cc Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "example.com"See Network Configuration for more information.
|
Smoke Test: Copilot BYOK (Direct) ModeRecent merged PRs (MCP check):
Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY) via api-proxy → api.githubcopilot.com Overall: PASS cc
|
github-actions
Bot
added
smoke-copilot-network-isolation
🧪 Copilot Engine Smoke Test
Recent merged PRs:
Overall: PASS ✅ cc
|
Smoke Test: Gemini Engine Validation
Overall Status: FAIL
|
Smoke Test: Service Connectivity
Overall: FAIL —
|
Chroot Version Comparison
Not all tests passed (
|
Smoke Test: Docker Sbx Validation
Overall: PASS cc
|
🏗️ Build Test Suite Results
Overall: 8/8 ecosystems passed — PASS Note: Java Maven runs initially failed with All 18 project builds/tests across all 8 ecosystems completed successfully through the AWF firewall.
|
Config Consistency Audit
Audited 15 merged PRs (Jul 31 – Aug 5, 2026) that touched configuration surfaces for consistency across JSON Schema, spec CLI mapping, TypeScript types, and env var wiring.
Summary
apiProxy.enableTokenSteeringdoc clarified, model alias filteringAWF_ENABLE_TOKEN_STEERINGinsrc/services/api-proxy-env-config.ts) all consistentboundedAgents.engineto spec CLI mappingsrc/awf-config-schema.json,docs/awf-config.schema.json, andsrc/config-file.ts/src/types/bounded-agent-options.ts--reflectCLI flag (src/cli-options.ts,src/commands/main-action.ts) to query the API proxy/reflectendpointdocs/awf-config-spec.md--reflectsrc/awf-config-schema.jsonanddocs/awf-config.schema.jsonremain identicalFix applied
Added a Section 5 CLI Mapping row for
--reflectindocs/awf-config-spec.md, marked CLI-only (no config-document equivalent), noting it's mutually exclusive with a command argument.Verification checklist
diff src/awf-config-schema.json docs/awf-config.schema.json— identical, no driftnpx jest src/config-file-mapping.test.ts src/schema.test.ts src/schema-validator.test.ts— 124 tests passed.option('--...')flags insrc/cli-options.tsagainst the spec's CLI mapping table —--reflectwas the only omission (after fix, all flags are now represented, aside from--no-network-isolationwhich is the negation form of the documented--network-isolationflag)