SUPPORTED_COPILOT_MODELS allowlist in src/copilot-model.ts is missing mai-code-1-flash, which is already priced in the api-proxy

[jaroslawgajewski]

Summary

AWF's host-side model validation (src/copilot-model.ts, validateCopilotModel()) rejects mai-code-1-flash before any container starts:

Error: model 'mai-code-1-flash' is retired or unsupported.

This is the same class of bug as #5752 (claude-sonnet-5 missing from the same allowlist, fixed in PR #5756 / AWF v0.27.21) — a model that exists and is already priced elsewhere in this same repo is missing from SUPPORTED_COPILOT_MODELS, and the generic "not in our list" case is worded as if the model were retired.

Root cause

mai-code-1-flash is not in SUPPORTED_COPILOT_MODELS (src/copilot-model.ts), so validateCopilotModel() falls through to the generic unsupported path. It doesn't hit RETIRED_COPILOT_MODEL_ALIASES either (that map only has real deprecation entries), and no fuzzy suggestion is offered (suggestionFor()'s Levenshtein cutoff is 6, and nothing in the current allowlist is close enough to mai-code-1-flash) — so the message says "retired or unsupported" with no alternative suggested, which is the least informative version of this failure mode.

Despite being absent from the CLI-validation allowlist, mai-code-1-flash is already a recognized, priced model elsewhere in this repo:

• containers/api-proxy/ai-credits-pricing.js: 'mai-code-1-flash': { input: 0.75, cachedInput: 0.075, cacheWrite: null, output: 4.50 }
• pkg/workflow/data/model_aliases.json (in github/gh-aw, the compiler repo): the mai-code family alias already matches copilot/MAI-Code*, copilot/mai-code*, openai/MAI-Code*

So two other parts of the toolchain already know this model exists and how to price/route it; only the host-side CLI gate doesn't.

Reproduction

1. Configure a workflow's Copilot engine with COPILOT_MODEL=mai-code-1-flash.
2. Run the workflow through AWF on a version with the copilot-model.ts host-side gate (reproduced on v0.27.16 — the same gate Sync Copilot model allowlist with model API mapping #5756 patched for other models).
3. Observe the host-side rejection before any container starts.

Suggested fix

• Add mai-code-1-flash to SUPPORTED_COPILOT_MODELS, following the same pattern as PR Sync Copilot model allowlist with model API mapping #5756.
• Given this is the second time a model has been priced/aliased elsewhere in the toolchain before making it into this specific allowlist, it might be worth having something (a lint check, a shared source of truth, or generating this list from the same data ai-credits-pricing.js/model_aliases.json already encode) so the three lists can't drift independently again. Sync Copilot model allowlist with model API mapping #5756's own description flagged the two-source-of-truth problem for docs/model-api-mapping.json vs. this allowlist — this is now a third list with its own version of the same model, so unifying feels increasingly worth it rather than patching each drift as it's found.

Version info

• gh-aw-firewall: reproduced on v0.27.16 (container image tag; this ran on the atos-pr-review canary workflow, which deliberately tracks native/unpinned AWF rather than this fleet's usual v0.25.55 pin)
• gh-aw compiler: v0.82.1
• Related: SUPPORTED_COPILOT_MODELS allowlist in src/copilot-model.ts is out of sync with docs/model-api-mapping.json — rejects valid models as "retired" #5752 / PR Sync Copilot model allowlist with model API mapping #5756 (same bug class, different model)