Fail closed on invalid API proxy model allowlists by Copilot · Pull Request #9358 · github/gh-aw-firewall

Copilot · 2026-10-02T02:38:21Z

A hardcoded harness fallback can request a model the BYOK operator did not approve. AWF already blocks models outside apiProxy.allowedModels, but an empty or malformed policy could silently disable that protection.

Policy enforcement: Preserve an explicitly empty allowlist through config handoff and reject empty or malformed model-policy values at proxy startup.
Fallback behavior: Cover rejection of an unsanctioned gpt-5.4 request before upstream dispatch, while approved models continue to forward.
Operator guidance: Document the BYOK allowlist and the distinction between an omitted policy and an invalid one.

{"apiProxy":{"allowedModels":["gpt-5.6-sol"]}}

With this policy, a harness request for gpt-5.4 receives HTTP 403.

Fixes [awf] api-proxy/model fallback: hardcoded terminal 'gpt-5.4' default defeats BYOK fail-closed #9351

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot

Copilot review overview

🟡 Changes recommended

Partially malformed policy arrays remain accepted instead of failing closed.

Review effort: Balanced
Findings: 1

Open (1)

Reject partially malformed model policy arrays · New

What changed in this PR

Enforces fail-closed API proxy model allowlists to prevent unauthorized fallback models.

Changes:

Preserves explicitly empty allowlists through configuration.
Rejects invalid policies and unauthorized requests.
Adds tests and operator documentation.

File	Description
`src/services/api-proxy-service-misc-forwarding.test.ts`	Tests empty-list forwarding.
`src/services/api-proxy-env-config.ts`	Preserves explicit allowlists.
`src/services/api-proxy-env-config.test.ts`	Tests environment serialization.
`docs/api-proxy-sidecar.md`	Documents BYOK restrictions.
`containers/api-proxy/server.model-policy.test.js`	Tests request enforcement.
`containers/api-proxy/guards/model-policy-guard.test.js`	Tests invalid-policy rejection.
`containers/api-proxy/guards/model-policy-guard.js`	Adds startup validation.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

+if (process.env.AWF_ALLOWED_MODELS !== undefined && !ALLOWED_MODELS) {
+  throw new Error('AWF_ALLOWED_MODELS must be a non-empty JSON array of model patterns');
+}
+if (process.env.AWF_DISALLOWED_MODELS !== undefined && !DISALLOWED_MODELS) {
+  throw new Error('AWF_DISALLOWED_MODELS must be a non-empty JSON array of model patterns');


lpcox · 2026-10-02T03:23:54Z

@copilot Fix the code for all comments in this review thread.

When a review comment includes a suggested change, apply the suggestion exactly.

Do not make changes beyond what is described in the linked review thread.

Copilot · 2026-10-02T03:28:33Z

@copilot Fix the code for all comments in this review thread.

When a review comment includes a suggested change, app...

Partially malformed model-policy arrays now fail closed for both allowlists and denylists. Focused tests pass. Commit: 49f4435.

github-actions · 2026-10-02T03:35:50Z

✅ Copilot review passed with no inline comments.

@copilot Add the ready-for-aw label to this PR to trigger agentic CI smoke tests.

github-actions · 2026-10-02T03:36:12Z

Documentation Preview

Documentation has been built for this PR.

Download preview artifact

To view locally:

Download the docs-preview-pr-9358 artifact from the workflow run
Unzip and open index.html in your browser

Built from commit 12295c2

github-actions · 2026-10-02T03:36:28Z

✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓

🔑 BYOK report filed by Smoke Copilot BYOK

github-actions · 2026-10-02T03:36:29Z

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

🔮 The oracle has spoken through Smoke Codex

github-actions · 2026-10-02T03:36:29Z

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

📰 BREAKING: Report filed by Smoke Copilot

github-actions · 2026-10-02T03:36:29Z

Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded.

Tested by Smoke Chroot

github-actions · 2026-10-02T03:36:31Z

📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅

📡 OTel tracing validated by Smoke OTel Tracing

github-actions · 2026-10-02T03:36:33Z

Smoke Cloud Hypervisor reports failed. Cloud Hypervisor + Copilot failed.

Cloud Hypervisor + Copilot smoke test by Smoke Cloud Hypervisor

github-actions · 2026-10-02T03:36:33Z

🔌 Smoke Services — All services reachable! ✅

🔌 Service connectivity validated by Smoke Services

github-actions · 2026-10-02T03:36:33Z

✅ Security Guard completed successfully!

Security review of PR #9358 complete: 1 security-relevant file changed (containers/api-proxy/guards/model-policy-guard.js). Changes implement fail-closed validation with early error throwing on misconfigured model allowlists/denylists. No security-weakening changes detected. No firewall rules loosened, no capabilities added, no ACL regressions. PR passes security review.

Generated by Security Guard for #9358

github-actions · 2026-10-02T03:36:34Z

❌ Smoke Copilot BYOK AOAI (Entra) reports failed. AOAI BYOK (Entra) mode investigation needed...

🪪 BYOK (AOAI Entra) report filed by Smoke Copilot BYOK AOAI (Entra)

github-actions · 2026-10-02T03:36:41Z

❌ Smoke Gemini reports failed. Facets need polishing...

💎 Faceted by Smoke Gemini

github-actions · 2026-10-02T03:36:42Z

❌ Smoke Copilot BYOK AOAI (api-key) reports failed. AOAI BYOK (api-key) mode investigation needed...

🔑 BYOK (AOAI api-key) report filed by Smoke Copilot BYOK AOAI (api-key)

github-actions · 2026-10-02T03:36:42Z

🛡️ Smoke Copilot Network Isolation confirmed the egress allowlist is enforced. ✅

🛡️ Egress verdict from Smoke Copilot Network Isolation

github-actions · 2026-10-02T03:36:44Z

✅ Build Test Suite completed successfully!

Generated by Build Test Suite for #9358

github-actions · 2026-10-02T03:36:48Z

✅ Smoke Claude passed

Generated by Smoke Claude for #9358

github-actions · 2026-10-02T03:39:22Z

Smoke Test: Copilot BYOK (Direct) Mode ✅

Test	Result
GitHub MCP Connectivity	✅
github.com HTTP Connectivity	✅ (HTTP 200)
File Write/Read	✅
BYOK Inference Path	✅

Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY) via api-proxy → api.githubcopilot.com

Overall Status: PASS

🔑 BYOK report filed by Smoke Copilot BYOK
_{Add label ready-for-aw to run again}

github-actions · 2026-10-02T03:39:38Z

Smoke Copilot: PASS

✅ GitHub MCP (last merged PR: "test: make cloud hypervisor tests portable")
✅ github.com HTTP 200
✅ File write/read
cc @Copilot @lpcox

📰 BREAKING: Report filed by Smoke Copilot
_{Add label ready-for-aw to run again}

github-actions · 2026-10-02T03:39:55Z

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	92.77%	92.78%	📈 +0.01%
Statements	91.29%	91.30%	➡️ +0.01%
Functions	89.35%	89.35%	➡️ +0.00%
Branches	84.60%	84.61%	📈 +0.01%

📁 Per-file Coverage Changes (1 files)

File	Lines (Before → After)	Statements (Before → After)
`src/log-directory-setup.ts`	96.2% → 100.0% (+3.78%)	96.3% → 100.0% (+3.71%)

Coverage comparison generated by scripts/ci/compare-coverage.ts

github-actions · 2026-10-02T03:40:08Z

Smoke Test: Claude Engine Validation

API status: ✅ PASS
GH check: ✅ PASS
File status: ✅ PASS

Overall result: PASS

Generated by Smoke Claude for #9358 · claude · haiku45 · 24.2 AIC · ⊞ 6.2K · ◷
_{Add label ready-for-aw to run again}

github-actions · 2026-10-02T03:40:16Z

Smoke services: ✅ Redis PONG · ✅ pg_isready accepting connections · ✅ psql SELECT 1 → 1. PASS

🔌 Service connectivity validated by Smoke Services
_{Add label ready-for-aw to run again}

github-actions · 2026-10-02T03:40:27Z

EGRESS_RESULT allow=pass deny=pass

✅ Allowed domain (api.github.com): 200
✅ Blocked domain (example.com): blocked
Overall: PASS — @Copilot

🛡️ Egress verdict from Smoke Copilot Network Isolation
_{Add label ready-for-aw to run again}

github-actions · 2026-10-02T03:40:36Z

OTEL smoke test

✅ 1 Module loading: otel.js loads (exports startRequestSpan, setTokenAttributes, setBudgetAttributes, endSpan, endSpanError, shutdown, isEnabled, ...)
✅ 2 Tests: 3 suites, 68/68 OTEL tests pass
✅ 3 Env forwarding: trace/parent span IDs in env-passthrough.ts; OTEL endpoint/headers/trace vars in api-proxy-env-config.ts
✅ 4 Token tracker: onUsage hook present in token-tracker-http.js
✅ 5 Diagnostics: /tmp/gh-aw/otel.jsonl present (1 entry); no api-proxy span export confirmed here

📡 OTel tracing validated by Smoke OTel Tracing
_{Add label ready-for-aw to run again}

github-actions · 2026-10-02T03:41:17Z

Smoke Test

Last 2 merged PRs: ❌
2 PR details: ❌
Playwright title check: ❌
Temp file write/read: ❌
AWF build: ❌
Overall: FAIL

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

github-actions · 2026-10-02T03:41:40Z

Chroot Version Comparison

Runtime	Host Version	Chroot Version	Match?
Python	Python 3.12.14	Python 3.12.14	✅ YES
Node.js	v24.21.0	v2.98.0	❌ NO
Go	go1.22.12	go1.22.12	✅ YES

Result: Not all tests passed. Node.js differs between host and chroot, so the smoke-chroot label was not added.

Tested by Smoke Chroot
_{Add label ready-for-aw to run again}

github-actions · 2026-10-02T03:41:43Z

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	❌	not run	❌ FAIL
Bun	hono	❌	not run	❌ FAIL
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	❌	not run	❌ FAIL
Deno	std	❌	not run	❌ FAIL
.NET	hello-world	✅	N/A	✅ PASS
.NET	json-parse	✅	N/A	✅ PASS
Go	color	✅	all passed	✅ PASS
Go	env	✅	all passed	✅ PASS
Go	uuid	✅	all passed	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	all passed	✅ PASS
Node.js	execa	✅	all passed	✅ PASS
Node.js	p-limit	✅	all passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 6/8 ecosystems passed — FAIL

Failures

Bun / Deno: the install step (curl -fsSL https://bun.sh/install | bash, curl -fsSL https://deno.land/install.sh | sh) was blocked with "Permission denied and could not request permission from user", so bun and deno were not installed and no tests ran.
Note: Java needed -Dmaven.repo.local=/tmp/... because ~/.m2/repository was not writable. Results are otherwise unaffected.

Generated by Build Test Suite for #9358 · copilot · auto · 22.7 AIC · ⊞ 11.8K · ◷
_{Add label ready-for-aw to run again}

Initial plan

2e63362

Copilot AI assigned Copilot and lpcox Oct 2, 2026

Copilot started work on behalf of lpcox October 2, 2026 02:39 View session

Copilot AI linked an issue Oct 2, 2026 that may be closed by this pull request

[awf] api-proxy/model fallback: hardcoded terminal 'gpt-5.4' default defeats BYOK fail-closed #9351

Closed

fix: fail closed on invalid API proxy model policies

81b5228

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Fix hardcoded terminal default in API proxy model fallback~~ Fail closed on invalid API proxy model allowlists Oct 2, 2026

Copilot AI requested a review from lpcox October 2, 2026 02:46

Copilot finished work on behalf of lpcox October 2, 2026 02:46

lpcox marked this pull request as ready for review October 2, 2026 03:19

Copilot AI balanced review requested due to automatic review settings October 2, 2026 03:19

Copilot started reviewing on behalf of lpcox October 2, 2026 03:20 View session

Copilot AI reviewed Oct 2, 2026

View reviewed changes

Copilot started work on behalf of lpcox October 2, 2026 03:24 View session

fix: reject partially malformed model policies

49f4435

Copilot finished work on behalf of lpcox October 2, 2026 03:28

lpcox added the ready-for-aw label Oct 2, 2026

lpcox enabled auto-merge (squash) October 2, 2026 03:36

lpcox had a problem deploying to aoai-model October 2, 2026 03:36 — with GitHub Actions Failure

github-actions Bot added the smoke-copilot-byok label Oct 2, 2026

github-actions Bot added the smoke-copilot label Oct 2, 2026

lpcox deployed to aoai-model October 2, 2026 03:40 — with GitHub Actions Active

github-actions Bot added the smoke-claude label Oct 2, 2026

github-actions Bot added the smoke-services label Oct 2, 2026

lpcox deployed to aoai-model October 2, 2026 03:40 — with GitHub Actions Active

github-actions Bot added the smoke-copilot-network-isolation Copilot network-isolation egress smoke test label Oct 2, 2026

lpcox merged commit 0c62af4 into main Oct 2, 2026
132 of 137 checks passed

lpcox deleted the copilot/awf-api-proxy-model-allowlist branch October 2, 2026 03:49

This was referenced Oct 2, 2026

fix: report and export the api-proxy token-usage log path for arc-dind runs #9357

Merged

Enforce Cloud Hypervisor enclave resource limits #9349

Merged

[deps-release-notes] awf — upstream release action items githubnext/ado-aw#2252

Open

Conversation

Copilot AI commented Oct 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

lpcox commented Oct 2, 2026

Uh oh!

Copilot AI commented Oct 2, 2026

Uh oh!

github-actions Bot commented Oct 2, 2026

Uh oh!

github-actions Bot commented Oct 2, 2026

Documentation Preview

Uh oh!

github-actions Bot commented Oct 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 2, 2026

Smoke Test: Copilot BYOK (Direct) Mode ✅

Uh oh!

github-actions Bot commented Oct 2, 2026

Uh oh!

github-actions Bot commented Oct 2, 2026

✅ Coverage Check Passed

Overall Coverage

Uh oh!

github-actions Bot commented Oct 2, 2026

Smoke Test: Claude Engine Validation

Uh oh!

github-actions Bot commented Oct 2, 2026

Uh oh!

github-actions Bot commented Oct 2, 2026

Uh oh!

github-actions Bot commented Oct 2, 2026

Uh oh!

github-actions Bot commented Oct 2, 2026

Smoke Test

Copilot AI commented Oct 2, 2026 •

edited

Loading

github-actions Bot commented Oct 2, 2026 •

edited

Loading

github-actions Bot commented Oct 2, 2026 •

edited

Loading

github-actions Bot commented Oct 2, 2026 •

edited

Loading

github-actions Bot commented Oct 2, 2026 •

edited

Loading

github-actions Bot commented Oct 2, 2026 •

edited

Loading

github-actions Bot commented Oct 2, 2026 •

edited

Loading

github-actions Bot commented Oct 2, 2026 •

edited

Loading

github-actions Bot commented Oct 2, 2026 •

edited

Loading

github-actions Bot commented Oct 2, 2026 •

edited

Loading

github-actions Bot commented Oct 2, 2026 •

edited

Loading

github-actions Bot commented Oct 2, 2026 •

edited

Loading

github-actions Bot commented Oct 2, 2026 •

edited

Loading

github-actions Bot commented Oct 2, 2026 •

edited

Loading

github-actions Bot commented Oct 2, 2026 •

edited

Loading