fix: configure bounded-agent smoke workflows at runtime

[lpcox]

Summary

• move bounded-agent config injection into the replacement awf wrapper
• patch the compiler-generated --config file immediately before AWF starts
• preserve the existing API-proxy configuration and select Docker or gVisor per workflow
• add regression coverage that executes both generated wrappers against a late-created config

Root cause

pre-agent-steps run before gh-aw creates ${RUNNER_TEMP}/gh-aw/awf-config.json. Both smoke workflows attempted to read that file during setup, so they failed with ENOENT before AWF or a bounded agent started.

Validation

• gh aw compile smoke-bounded-agents smoke-bounded-agents-gvisor --validate
• smoke workflow post-processing
• targeted generated-wrapper tests
• Markdown lint
• npm run build
• npm run lint
• npm test -- --runInBand

[Copilot]

Pull request overview

Moves bounded-agent configuration to runtime so generated AWF configs exist before patching.

Changes:

• Adds Docker and gVisor runtime wrappers.
• Regenerates both locked workflows.
• Adds wrapper regression tests.

Show a summary per file

File	Description
scripts/ci/smoke-bounded-agents-workflow.test.ts	Tests generated wrappers and config patching.
.github/workflows/smoke-bounded-agents.md	Adds Docker runtime configuration wrapper.
.github/workflows/smoke-bounded-agents.lock.yml	Regenerates the Docker workflow lock.
.github/workflows/smoke-bounded-agents-gvisor.md	Adds gVisor runtime configuration wrapper.
.github/workflows/smoke-bounded-agents-gvisor.lock.yml	Regenerates the gVisor workflow lock.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 5/5 changed files
• Comments generated: 1
• Review effort level: Balanced

[github-actions]

⚠️ Coverage Regression Detected

This PR decreases test coverage. Please add tests to maintain coverage levels.

Overall Coverage

Metric	Base	PR	Delta
Lines	98.94%	98.95%	📈 +0.01%
Statements	98.83%	98.83%	➡️ +0.00%
Functions	99.19%	99.19%	➡️ +0.00%
Branches	95.15%	95.12%	📉 -0.03%

📁 Per-file Coverage Changes (2 files)

File	Lines (Before → After)	Statements (Before → After)
src/artifact-preservation.ts	96.3% → 95.0% (-1.26%)	96.3% → 95.0% (-1.25%)
src/log-directory-setup.ts	96.2% → 100.0% (+3.78%)	96.3% → 100.0% (+3.71%)

---

Coverage comparison generated by scripts/ci/compare-coverage.ts

[github-actions]

✅ Copilot review passed with no inline comments.

@lpcox Add the ready-for-aw label to this PR to trigger agentic CI smoke tests.

[github-actions]

⚠️ Coverage Regression Detected

This PR decreases test coverage. Please add tests to maintain coverage levels.

Overall Coverage

Metric	Base	PR	Delta
Lines	98.94%	98.95%	📈 +0.01%
Statements	98.83%	98.83%	➡️ +0.00%
Functions	99.19%	99.19%	➡️ +0.00%
Branches	95.15%	95.12%	📉 -0.03%

📁 Per-file Coverage Changes (2 files)

File	Lines (Before → After)	Statements (Before → After)
src/artifact-preservation.ts	96.3% → 95.0% (-1.26%)	96.3% → 95.0% (-1.25%)
src/log-directory-setup.ts	96.2% → 100.0% (+3.78%)	96.3% → 100.0% (+3.71%)

---

Coverage comparison generated by scripts/ci/compare-coverage.ts

[github-actions]

⚠️ Coverage Regression Detected

This PR decreases test coverage. Please add tests to maintain coverage levels.

Overall Coverage

Metric	Base	PR	Delta
Lines	98.94%	98.95%	📈 +0.01%
Statements	98.83%	98.83%	➡️ +0.00%
Functions	99.19%	99.19%	➡️ +0.00%
Branches	95.15%	95.12%	📉 -0.03%

📁 Per-file Coverage Changes (2 files)

File	Lines (Before → After)	Statements (Before → After)
src/artifact-preservation.ts	96.3% → 95.0% (-1.26%)	96.3% → 95.0% (-1.25%)
src/log-directory-setup.ts	96.2% → 100.0% (+3.78%)	96.3% → 100.0% (+3.71%)

---

Coverage comparison generated by scripts/ci/compare-coverage.ts

[github-actions]

⚠️ Coverage Regression Detected

This PR decreases test coverage. Please add tests to maintain coverage levels.

Overall Coverage

Metric	Base	PR	Delta
Lines	98.94%	98.95%	📈 +0.01%
Statements	98.83%	98.83%	➡️ +0.00%
Functions	99.19%	99.19%	➡️ +0.00%
Branches	95.15%	95.12%	📉 -0.03%

📁 Per-file Coverage Changes (2 files)

File	Lines (Before → After)	Statements (Before → After)
src/artifact-preservation.ts	96.3% → 95.0% (-1.26%)	96.3% → 95.0% (-1.25%)
src/log-directory-setup.ts	96.2% → 100.0% (+3.78%)	96.3% → 100.0% (+3.71%)

---

Coverage comparison generated by scripts/ci/compare-coverage.ts

[github-actions]

⚠️ Coverage Regression Detected

This PR decreases test coverage. Please add tests to maintain coverage levels.

Overall Coverage

Metric	Base	PR	Delta
Lines	98.94%	98.95%	📈 +0.01%
Statements	98.83%	98.83%	➡️ +0.00%
Functions	99.19%	99.19%	➡️ +0.00%
Branches	95.15%	95.12%	📉 -0.03%

📁 Per-file Coverage Changes (2 files)

File	Lines (Before → After)	Statements (Before → After)
src/artifact-preservation.ts	96.3% → 95.0% (-1.26%)	96.3% → 95.0% (-1.25%)
src/log-directory-setup.ts	96.2% → 100.0% (+3.78%)	96.3% → 100.0% (+3.71%)

---

Coverage comparison generated by scripts/ci/compare-coverage.ts

[github-actions]

⚠️ Coverage Regression Detected

This PR decreases test coverage. Please add tests to maintain coverage levels.

Overall Coverage

Metric	Base	PR	Delta
Lines	98.94%	98.95%	📈 +0.01%
Statements	98.83%	98.83%	➡️ +0.00%
Functions	99.19%	99.19%	➡️ +0.00%
Branches	95.15%	95.12%	📉 -0.03%

📁 Per-file Coverage Changes (2 files)

File	Lines (Before → After)	Statements (Before → After)
src/artifact-preservation.ts	96.3% → 95.0% (-1.26%)	96.3% → 95.0% (-1.25%)
src/log-directory-setup.ts	96.2% → 100.0% (+3.78%)	96.3% → 100.0% (+3.71%)

---

Coverage comparison generated by scripts/ci/compare-coverage.ts

[github-actions]

⚠️ Coverage Regression Detected

This PR decreases test coverage. Please add tests to maintain coverage levels.

Overall Coverage

Metric	Base	PR	Delta
Lines	98.94%	98.95%	📈 +0.01%
Statements	98.83%	98.83%	➡️ +0.00%
Functions	99.19%	99.19%	➡️ +0.00%
Branches	95.15%	95.12%	📉 -0.03%

📁 Per-file Coverage Changes (2 files)

File	Lines (Before → After)	Statements (Before → After)
src/artifact-preservation.ts	96.3% → 95.0% (-1.26%)	96.3% → 95.0% (-1.25%)
src/log-directory-setup.ts	96.2% → 100.0% (+3.78%)	96.3% → 100.0% (+3.71%)

---

Coverage comparison generated by scripts/ci/compare-coverage.ts

[github-actions]

⚠️ Coverage Regression Detected

This PR decreases test coverage. Please add tests to maintain coverage levels.

Overall Coverage

Metric	Base	PR	Delta
Lines	98.94%	98.95%	📈 +0.01%
Statements	98.83%	98.83%	➡️ +0.00%
Functions	99.19%	99.19%	➡️ +0.00%
Branches	95.15%	95.12%	📉 -0.03%

📁 Per-file Coverage Changes (2 files)

File	Lines (Before → After)	Statements (Before → After)
src/artifact-preservation.ts	96.3% → 95.0% (-1.26%)	96.3% → 95.0% (-1.25%)
src/log-directory-setup.ts	96.2% → 100.0% (+3.78%)	96.3% → 100.0% (+3.71%)

---

Coverage comparison generated by scripts/ci/compare-coverage.ts

[github-actions]

Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded.

[github-actions]

✅ Smoke Claude passed

[github-actions]

EGRESS_RESULT allow=pass deny=pass

✅ Allowed domain (github.com) reachable: allowed=200
✅ Blocked domain (example.com) denied: 403 CONNECT tunnel failed

Overall: PASS

cc @lpcox

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• example.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "example.com"

See Network Configuration for more information.

🛡️ Egress verdict from Smoke Copilot Network Isolation
_{Add label ready-for-aw to run again}

[github-actions]

Smoke Test: Copilot Engine — @lpcox

• ✅ GitHub MCP: PR fix: demote benign rootless cleanup errors #6939 fix: demote benign rootless cleanup errors
• ✅ GitHub.com connectivity: HTTP 200
• ✅ File write/read test passed

Overall: PASS

📰 BREAKING: Report filed by Smoke Copilot
_{Add label ready-for-aw to run again}

[github-actions]

Smoke Test: Copilot BYOK (Direct) Mode

• ✅ GitHub MCP: PR fix: demote benign rootless cleanup errors #6939 fix: demote benign rootless cleanup errors; PR [WIP] Fix token steering to respect explicit provider configuration #6924 [WIP] Fix token steering to respect explicit provider configuration
• ✅ GitHub.com connectivity (HTTP 200)
• ✅ File write/read test passed
• ✅ BYOK inference test

Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY) via api-proxy → api.githubcopilot.com

Overall: PASS

cc @lpcox

🔑 BYOK report filed by Smoke Copilot BYOK
_{Add label ready-for-aw to run again}

[github-actions]

Smoke Test: GitHub Actions Services Connectivity

• Redis PING: ❌ (DNS resolution failure for host.docker.internal)
• PostgreSQL pg_isready: ❌ (no response)
• PostgreSQL SELECT 1: ❌ (DNS resolution failure)

Overall: FAIL — could not resolve host.docker.internal from within the AWF sandbox.

🔌 Service connectivity validated by Smoke Services
_{Add label ready-for-aw to run again}

[github-actions]

Smoke Test: Claude Engine Validation

Overall result: ✅ PASS

Check	Status
API	✅ PASS
gh CLI	✅ PASS
File	✅ PASS

Generated by Smoke Claude for #6908 · haiku45 · 55.7 AIC · ⊞ 3.6K · ◷
_{Add label ready-for-aw to run again}

[github-actions]

Smoke Test: API Proxy OTel Tracing — Results

• ✅ Scenario 1 (Module Loading): otel.js loads successfully, isEnabled: true, exports startRequestSpan, setTokenAttributes, setBudgetAttributes, endSpan, endSpanError, shutdown, isEnabled + internal helpers.
• ✅ Scenario 2 (Test Suite): npx jest --testPathPatterns=otel → 3 suites, 68 tests, all passed (otel.test.js, otel-fanout.test.js, otel-workload-identity.test.js).
• ✅ Scenario 3 (Env Var Forwarding): env-passthrough.ts forwards GITHUB_AW_OTEL_TRACE_ID and GITHUB_AW_OTEL_PARENT_SPAN_ID to the agent; api-proxy-env-config.ts forwards GH_AW_OTLP_ENDPOINTS, OTEL_EXPORTER_OTLP_ENDPOINT, plus trace context to the api-proxy container.
• ✅ Scenario 4 (Token Tracker Integration): token-tracker-http.js contains the onUsage callback hook point used by OTEL.
• ✅ Scenario 5 (OTEL Diagnostics): /tmp/gh-aw/otel.jsonl contains 1 exported span batch (1 span) for this run, confirming OTLP export worked end-to-end.

Overall: All 5 scenarios passed.

📡 OTel tracing validated by Smoke OTel Tracing
_{Add label ready-for-aw to run again}

[github-actions]

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A (run OK)	✅ PASS
.NET	json-parse	✅	N/A (run OK)	✅ PASS
Go	color	✅	ok	✅ PASS
Go	env	✅	ok	✅ PASS
Go	uuid	✅	ok	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	all passed	✅ PASS
Node.js	execa	✅	all passed	✅ PASS
Node.js	p-limit	✅	all passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — PASS

Note: Java initially failed due to /home/runner/.m2/repository having root ownership (pre-existing environment issue unrelated to the firewall); retried successfully using -Dmaven.repo.local pointing at a writable path. No other issues encountered.

Generated by Build Test Suite for #6908 · auto · 53.9 AIC · ⊞ 11.5K · ◷
_{Add label ready-for-aw to run again}

[github-actions]

Chroot Version Comparison Results

Runtime	Host Version	Chroot Version	Match?
Python	Python 3.12.13	Python 3.12.13	✅ YES
Node.js	v24.18.0	v22.23.1	❌ NO
Go	go1.22.12	go1.22.12	✅ YES

Overall: FAILED — Node.js version mismatch between host (v24.18.0) and chroot environment (v22.23.1). No label applied since not all tests passed.

Tested by Smoke Chroot
_{Add label ready-for-aw to run again}

[github-actions]

Smoke Test: Docker Sbx — Overall: PASS

• ✅ GitHub MCP connectivity (PRs: fix: demote benign rootless cleanup errors #6939 fix: demote benign rootless cleanup errors, [WIP] Fix token steering to respect explicit provider configuration #6924 [WIP] Fix token steering to respect explicit provider configuration)
• ✅ GitHub.com connectivity (HTTP 200)
• ✅ File write/read test

cc @lpcox

📰 BREAKING: Report filed by Smoke Docker Sbx
_{Add label ready-for-aw to run again}

[github-actions]

Merged PRs reviewed: fix: demote benign rootless cleanup errors; [WIP] Fix token steering to respect explicit provider configuration

✅ GitHub PR query
✅ Playwright title check
✅ File write/read
❌ Build (npm ci hit 403 fetching yocto-queue)

Overall: FAIL

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

[github-actions]

Gemini Smoke Test: PASS. Connectivity ✅, File Writing ✅, MCP ❌ (Policy).

💎 Faceted by Smoke Gemini
_{Add label ready-for-aw to run again}