feat(api-proxy): enforce per-request ephemeral token validation on all proxy endpoints

[Copilot]

The api-proxy sidecar forwarded all requests to upstream LLM APIs regardless of inbound credentials — any process on the 172.30.0.0/24 subnet could invoke real Anthropic/OpenAI/Copilot credentials with no x-api-key or a fabricated key.

Approach

Generate a cryptographically random 32-byte token (AWF_PROXY_TOKEN) per AWF invocation and validate it on every non-/health request. The proxy rejects unauthenticated callers with HTTP 401; if AWF_PROXY_TOKEN is not configured at all, all non-health requests are rejected.

Changes

• src/cli.ts: Generate crypto.randomBytes(32).toString('hex') as config.proxyToken when --enable-api-proxy is active.
• src/types.ts: Add proxyToken?: string to WrapperConfig.
• src/docker-manager.ts:
  • Pass AWF_PROXY_TOKEN to both the api-proxy and agent container environments.
  • Replace hardcoded 'placeholder-token-for-credential-isolation' strings with config.proxyToken for ANTHROPIC_AUTH_TOKEN, COPILOT_TOKEN, and COPILOT_GITHUB_TOKEN.
• containers/agent/get-claude-key.sh: Output $AWF_PROXY_TOKEN instead of a static placeholder, so Claude Code's apiKeyHelper sends the real ephemeral token.
• containers/api-proxy/server.js:
  • extractInboundToken(req) — extracts token from x-api-key or Authorization: Bearer.
  • validateProxyAuth(req) — timing-safe comparison against process.env.AWF_PROXY_TOKEN; returns false if token absent, wrong, or env var unset.
  • rejectUnauthorized(res, provider) — emits HTTP 401 with WWW-Authenticate: ******"awf-api-proxy".
  • Auth check wired before rate-limiting on all four endpoints (OpenAI :10000, Anthropic :10001, Copilot :10002, OpenCode :10004); /health paths are exempt.

Token flow

AWF CLI  →  crypto.randomBytes(32)  →  AWF_PROXY_TOKEN
              ↓                              ↓
         agent container              api-proxy container
    (ANTHROPIC_AUTH_TOKEN,           (validates every non-
     COPILOT_TOKEN, etc.)             /health request)

The real LLM API keys remain exclusively in the api-proxy container. The ephemeral token only authorises access to the proxy itself — not to the upstream provider.

---

⌨️ Start Copilot coding agent tasks without leaving your editor — available in VS Code, Visual Studio, JetBrains IDEs and Eclipse.