feat(cli): add API proxy reflection mode - #6936
Conversation
Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
Adds a dedicated --reflect mode for querying the API proxy’s reflection endpoint.
Changes:
- Adds the
--reflectCLI option and command validation. - Executes
/reflectthrough the AWF agent. - Adds unit tests and usage documentation.
Show a summary per file
| File | Description |
|---|---|
src/commands/main-action.ts |
Implements reflection-mode execution. |
src/commands/main-action.test.ts |
Tests reflection mode and command conflicts. |
src/cli-options.ts |
Registers the new CLI option. |
README.md |
Documents reflection usage. |
Review details
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 4/4 changed files
- Comments generated: 1
- Review effort level: Balanced
|
✅ Copilot review passed with no inline comments. @copilot Add the |
|
| Metric | Base | PR | Delta |
|---|---|---|---|
| Lines | 98.94% | 98.89% | 📉 -0.05% |
| Statements | 98.83% | 98.78% | 📉 -0.05% |
| Functions | 99.19% | 99.10% | 📉 -0.09% |
| Branches | 95.15% | 94.96% | 📉 -0.19% |
📁 Per-file Coverage Changes (6 files)
| File | Lines (Before → After) | Statements (Before → After) |
|---|---|---|
src/artifact-preservation.ts |
96.3% → 93.2% (-3.08%) | 96.3% → 93.2% (-3.06%) |
src/services/bounded-agent-service.ts |
98.5% → 97.0% (-1.45%) | 97.1% → 95.8% (-1.31%) |
src/bounded-agent/preflight.ts |
97.6% → 97.0% (-0.67%) | 97.7% → 97.1% (-0.64%) |
src/commands/main-action.ts |
97.3% → 97.4% (+0.07%) | 96.8% → 96.9% (+0.08%) |
src/artifact-permissions.ts |
97.4% → 98.0% (+0.52%) | 97.4% → 98.0% (+0.52%) |
src/log-directory-setup.ts |
96.2% → 100.0% (+3.78%) | 96.3% → 100.0% (+3.71%) |
Coverage comparison generated by scripts/ci/compare-coverage.ts
lpcox
changed the title
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 2e281ab2-e1f4-42a2-9798-47863526dc60
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 2e281ab2-e1f4-42a2-9798-47863526dc60
|
📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅ |
|
✅ Security Guard completed successfully! Security review complete for PR #6936. Changes to containers/agent/entrypoint.sh add output routing via file descriptor manipulation to separate entrypoint diagnostics from user command stdout. No security-weakening changes detected: no capability additions, no firewall chain modifications, no proxy/domain bypass, no input validation weakening, no secrets exposure, no seccomp relaxations. The output isolation pattern improves separation of concerns. PR passes security review. |
|
✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓 |
|
Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded. |
|
🛡️ Smoke Copilot Network Isolation confirmed the egress allowlist is enforced. ✅ |
|
❌ Smoke Copilot BYOK AOAI (Entra) reports failed. AOAI BYOK (Entra) mode investigation needed... |
|
✅ Smoke Claude passed |
|
❌ Smoke Copilot BYOK AOAI (api-key) reports failed. AOAI BYOK (api-key) mode investigation needed... |
|
📰 VERDICT: Smoke Docker Sbx has concluded. All systems operational. This is a developing story. 🎤 |
|
🔌 Smoke Services — All services reachable! ✅ |
|
📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤 |
|
❌ Smoke Copilot BYOK AOAI (Entra) reports failed. AOAI BYOK (Entra) mode investigation needed... |
|
📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅ |
|
✅ Security Guard completed successfully! Security review complete for PR #6936. Analysis: Changes are confined to containers/agent/entrypoint.sh and add output routing functions to isolate command stdout from entrypoint diagnostics. No DROP/REJECT rules weakened, no capabilities added, no ACL expansion, no input validation weakening, no secrets exposed. Changes maintain existing security boundaries. No security issues found. |
|
✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟 |
|
✅ Smoke Gemini completed. All facets verified. 💎 |
|
🛡️ Smoke Copilot Network Isolation confirmed the egress allowlist is enforced. ✅ |
Smoke Test: Copilot BYOK (Direct) Mode
Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY) via api-proxy → api.githubcopilot.com Overall: PASS cc
|
|
Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded. |
|
Smoke Test: Copilot Engine — Overall: ✅ PASS
cc
|
Smoke Test: Claude Engine Validation
Overall result: PASS
|
Smoke Test Results: Services Connectivity
Overall: FAIL —
|
Smoke Test: API Proxy OTEL Tracing — All Scenarios ✅
All scenarios pass — OTEL tracing integration validated.
|
|
EGRESS_RESULT allow=pass deny=pass ✅ Allowed domain (api.github.com) reachable: Overall: PASS
Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "example.com"See Network Configuration for more information.
|
Smoke Test: Gemini Engine Validation
FAIL
|
🏗️ Build Test Suite Results
Overall: 8/8 ecosystems passed — ✅ PASS All repositories cloned and all 18 test projects built/ran/tested successfully through the AWF firewall (Squid proxy egress control). Note: Java required overriding the Maven
|
🧪 Smoke Test: Docker Sbx
Overall: PASS cc
|
|
feat(cli): add API proxy reflection mode
Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "registry.npmjs.org"See Network Configuration for more information.
|
Chroot Version Comparison Results
Overall: FAILED — Node.js version mismatch between host and chroot environment. Not adding the
|
PR #6936 (feat(cli): add API proxy reflection mode) introduced the --reflect CLI flag but did not add it to the Section 5 CLI Mapping table in docs/awf-config-spec.md. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
PR #6936 (feat(cli): add API proxy reflection mode) introduced the --reflect CLI flag but did not add it to the Section 5 CLI Mapping table in docs/awf-config-spec.md. Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
/reflect, and prints JSONThe completed implementation keeps entrypoint diagnostics on stderr so
awf --reflectstdout remains parseable JSON. The final security review found no vulnerabilities.