Model auto fails AI-credit pricing in isolated agent runtimes

[lpcox]

Summary

With gh-aw v0.84.1 and gh-aw-firewall v0.27.43, a Copilot workflow using model: auto fails before the agent starts when the agent runs under the gVisor runtime. The isolated agent cannot fetch the model catalog from http://api-proxy:10000/reflect, then the API proxy rejects auto because it has neither model-specific AI-credit pricing nor a configured fallback.

Observed behavior

The agent harness reports:

[copilot-harness] awf-reflect: fetching http://api-proxy:10000/reflect
[copilot-harness] awf-reflect: request failed: fetch failed
400 400 400 Model "auto" has no AI credits pricing and no default pricing is configured. Set apiProxy.defaultAiCreditsPricing ...

The harness retries four times, but each request fails identically with zero tokens consumed.

Failing run: https://github.com/github/gh-aw-mcpg/actions/runs/30668009638/job/91283146079?pr=10490

The same workflow succeeds with the default AWF runtime, where /reflect is reachable. The docker-sbx variant also failed at the agent execution step after the v0.84.1 upgrade, suggesting the behavior affects isolated agent runtimes generally.

Reproduction

Compile and run a Copilot workflow with no explicit top-level model (v0.84.1 generates auto) and:

engine:
  id: copilot
sandbox:
  agent:
    id: awf
    runtime: gvisor

Expected behavior

auto should work under supported isolated runtimes. Possible fixes include making /reflect reachable from the isolated agent, pricing the concrete model selected by auto, or supplying apiProxy.defaultAiCreditsPricing in generated AWF configuration.

Workaround

Pin a concrete priced model in workflow frontmatter, for example:

model: claude-sonnet-4.6

This avoids catalog-based auto resolution and restores the pre-v0.84.1 effective model for these workflows.