feat: preflight binary check for codex in AWF agent container by Copilot · Pull Request #2254 · github/gh-aw-firewall

Copilot · 2026-04-28T01:54:53Z

Intermittent runner slots lacking codex (or node for Copilot) produce a cryptic shell error and silently kill the agent job. This adds a fast-fail preflight check specific to the codex command, mirroring the existing AWF_REQUIRE_NODE mechanism for Copilot.

Changes

src/docker-manager.ts — detects when the agent command is codex and sets AWF_PREFLIGHT_BINARY=codex in the container environment
containers/agent/entrypoint.sh — reads AWF_PREFLIGHT_BINARY; if set, injects a command -v <binary> guard into the chroot startup script before exec'ing the user command; validates the value matches [a-zA-Z0-9_.-]+ to prevent shell injection
src/docker-manager.test.ts — tests for both the positive (codex → flag set) and negative (other commands → no flag) cases

When codex is missing inside the chroot, the failure now looks like:

[entrypoint][ERROR] Required binary 'codex' is not available inside AWF chroot.
[entrypoint][ERROR] Ensure 'codex' is installed on the runner and present in a PATH directory bind-mounted into /host.
[entrypoint][ERROR] Standard bind-mounted PATH directories: /usr/local/bin, /usr/bin, /bin, /opt.

Exit code 127, before any runner time is wasted.

Agent-Logs-Url: https://github.com/github/gh-aw-firewall/sessions/ff25ad6d-c857-47bb-ac9b-28f16da6f6a4

github-actions · 2026-04-28T02:53:53Z

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	86.02%	86.11%	📈 +0.09%
Statements	86.02%	86.11%	📈 +0.09%
Functions	88.04%	88.04%	➡️ +0.00%
Branches	80.20%	80.25%	📈 +0.05%

📁 Per-file Coverage Changes (1 files)

File	Lines (Before → After)	Statements (Before → After)
`src/docker-manager.ts`	87.2% → 87.5% (+0.33%)	86.8% → 87.1% (+0.32%)

Coverage comparison generated by scripts/ci/compare-coverage.ts

Copilot

Pull request overview

Adds a fast-fail “preflight binary” check so AWF agent runs fail with a clear diagnostic when required runner-provided tooling (specifically codex) is missing inside the chrooted execution environment—similar in spirit to the existing Node preflight for Copilot.

Changes:

Set AWF_PREFLIGHT_BINARY=codex when the configured agent command executable is codex.
Extend the agent container entrypoint.sh to inject a command -v <binary> guard into the generated chroot startup script when AWF_PREFLIGHT_BINARY is present (with basic validation).
Add unit tests covering the env var being set for codex and absent for non-codex commands.

Show a summary per file

File	Description
src/docker-manager.ts	Detects `codex` command and sets `AWF_PREFLIGHT_BINARY` in agent container environment.
containers/agent/entrypoint.sh	Implements preflight check injection into the chroot startup script based on `AWF_PREFLIGHT_BINARY`.
src/docker-manager.test.ts	Adds tests ensuring `AWF_PREFLIGHT_BINARY` is set only for `codex` commands.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 3/3 changed files
Comments generated: 2

+  const isCodexCommand = commandExecutableBase.toLowerCase() === 'codex';
+  if (isCodexCommand) {
+    environment.AWF_PREFLIGHT_BINARY = 'codex';
+  }


+    # in the generated chroot startup script.
+    if [[ "${AWF_PREFLIGHT_BINARY}" =~ ^[a-zA-Z0-9_.-]+$ ]]; then
+      printf 'if ! command -v %s >/dev/null 2>&1; then\n' "${AWF_PREFLIGHT_BINARY}" >> "/host${SCRIPT_FILE}"


lpcox · 2026-04-28T03:22:09Z

@copilot address the review feedback

Agent-Logs-Url: https://github.com/github/gh-aw-firewall/sessions/003ed05c-0a7b-408c-b8f0-c18c8912a280

Copilot · 2026-04-28T03:25:47Z

@copilot address the review feedback

Both points addressed in d4d30d5:

AWF_PREFLIGHT_BINARY added to EXCLUDED_ENV_VARS so a host value can never be injected via --env-all.
Regex tightened to ^[a-zA-Z0-9_][a-zA-Z0-9_.-]*$ (alphanumeric/underscore first char required) and the generated check now uses command -v -- <binary> so the name is never parsed as an option.

github-actions · 2026-04-28T03:42:29Z

Smoke Test Results:
✅ GitHub MCP - Last 2 merged PRs retrieved
✅ Playwright - GitHub.com title verified
✅ File Writing - Test file created
✅ Bash Tool - File verification passed

Status: PASS

💥 [THE END] — Illustrated by Smoke Claude

github-actions · 2026-04-28T03:42:40Z

Smoke Test: Copilot BYOK — run#25032200440

Test	Result
GitHub MCP (list PRs)	✅
github.com connectivity	✅
File write/read	✅ (`smoke-test-copilot-byok-25032200440.txt`)
BYOK inference (this response)	✅

Running in BYOK offline mode (COPILOT_OFFLINE=true) via api-proxy → api.githubcopilot.com

Overall: PASS — PR by @Copilot, assignees: @lpcox @Copilot

🔑 BYOK report filed by Smoke Copilot BYOK

github-actions · 2026-04-28T03:43:09Z

🔥 Smoke Test Results — PR #2254

Test	Status
GitHub MCP connectivity	✅
GitHub.com HTTP connectivity	❌ (pre-step data unresolved)
File write/read	❌ (pre-step data unresolved)

Overall: FAIL — smoke-data step outputs were not substituted into the prompt.

PR: feat: preflight binary check for codex in AWF agent container
Author: @Copilot | Assignees: @lpcox, @Copilot

📰 BREAKING: Report filed by Smoke Copilot

github-actions · 2026-04-28T03:44:29Z

Chroot Version Comparison Results

Runtime	Host Version	Chroot Version	Match?
Python	`Python 3.12.13`	`Python 3.12.3`	❌
Node.js	`v24.14.1`	`v20.20.2`	❌
Go	`go1.22.12`	`go1.22.12`	✅

Result: ❌ Not all tests passed — Python and Node.js versions differ between host and chroot environments.

Tested by Smoke Chroot

github-actions · 2026-04-28T03:44:42Z

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A	✅ PASS
.NET	json-parse	✅	N/A	✅ PASS
Go	color	✅	1/1 passed	✅ PASS
Go	env	✅	1/1 passed	✅ PASS
Go	uuid	✅	1/1 passed	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	All passed	✅ PASS
Node.js	execa	✅	All passed	✅ PASS
Node.js	p-limit	✅	All passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — ✅ PASS

Generated by Build Test Suite for issue #2254 · ● 615.2K · ◷

github-actions · 2026-04-28T03:45:00Z

Smoke Test

chore: optimize test-coverage-improver workflow for ~50% token reduction
[Test Coverage] Add comprehensive tests for image-tag module
fix: retry awf-api-proxy health check failures and improve startup error messaging
feat: preflight binary check for codex in AWF agent container
MCP/PR reads ❌ Safe-input GitHub tools unavailable in session
Playwright ✅ Title contains GitHub
Tavily ❌ Search tool unavailable in session
File/Bash/Build ✅ PASS, PASS, PASS
Overall status: FAIL

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex

github-actions · 2026-04-28T03:45:10Z

Smoke Test Results

Redis PING: ❌ (timeout — no response from host.docker.internal:6379)
PostgreSQL pg_isready: ❌ (no response from host.docker.internal:5432)
PostgreSQL SELECT 1: ❌ (skipped — pg_isready failed)

Overall: FAIL — service containers are not reachable from this environment.

🔌 Service connectivity validated by Smoke Services

Initial plan

1f5da55

Copilot AI assigned Copilot and lpcox Apr 28, 2026

Copilot started work on behalf of lpcox April 28, 2026 01:59 View session

Copilot AI linked an issue Apr 28, 2026 that may be closed by this pull request

[awf] Agent Container: intermittent engine binary missing at startup (node/codex not found) #2247

Closed

feat: add preflight binary check for codex in agent entrypoint

2016a03

Agent-Logs-Url: https://github.com/github/gh-aw-firewall/sessions/ff25ad6d-c857-47bb-ac9b-28f16da6f6a4

Copilot AI changed the title ~~[WIP] Fix agent container issues with engine binaries at startup~~ feat: preflight binary check for codex in AWF agent container Apr 28, 2026

Copilot finished work on behalf of lpcox April 28, 2026 02:05

Copilot AI requested a review from lpcox April 28, 2026 02:05

lpcox marked this pull request as ready for review April 28, 2026 02:52

lpcox requested a review from Mossaka as a code owner April 28, 2026 02:52

Copilot AI review requested due to automatic review settings April 28, 2026 02:52

Copilot started reviewing on behalf of lpcox April 28, 2026 02:53 View session

This was referenced Apr 28, 2026

[aw] Build Test Suite failed #2257

Closed

[aw] Smoke Gemini failed #2258

Closed

This comment has been minimized.

Sign in to view

github-actions Bot added the smoke-copilot-byok label Apr 28, 2026

This comment has been minimized.

Sign in to view

Copilot AI reviewed Apr 28, 2026

View reviewed changes

github-actions Bot mentioned this pull request Apr 28, 2026

[aw] No-Op Runs #2249

Closed

This comment has been minimized.

Sign in to view

github-actions Bot added the smoke-claude label Apr 28, 2026

This comment has been minimized.

Sign in to view

Copilot started work on behalf of lpcox April 28, 2026 03:24 View session

fix: exclude AWF_PREFLIGHT_BINARY from env-all and tighten regex

d4d30d5

Agent-Logs-Url: https://github.com/github/gh-aw-firewall/sessions/003ed05c-0a7b-408c-b8f0-c18c8912a280

Copilot finished work on behalf of lpcox April 28, 2026 03:29

github-actions Bot added the build-test label Apr 28, 2026

lpcox merged commit cbee7bb into main Apr 28, 2026
64 of 68 checks passed

lpcox deleted the copilot/awf-fix-agent-container-issue branch April 28, 2026 04:22

github-actions Bot mentioned this pull request Apr 28, 2026

chore: upgrade to firewall v0.25.29 and mcpg v0.3.1 #2271

Merged

Conversation

Copilot AI commented Apr 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Uh oh!

github-actions Bot commented Apr 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Coverage Check Passed

Overall Coverage

Uh oh!

This comment has been minimized.

This comment has been minimized.

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

lpcox commented Apr 28, 2026

Uh oh!

Copilot AI commented Apr 28, 2026

Uh oh!

github-actions Bot commented Apr 28, 2026

Uh oh!

github-actions Bot commented Apr 28, 2026

Uh oh!

github-actions Bot commented Apr 28, 2026

🔥 Smoke Test Results — PR #2254

Uh oh!

github-actions Bot commented Apr 28, 2026

Chroot Version Comparison Results

Uh oh!

github-actions Bot commented Apr 28, 2026

🏗️ Build Test Suite Results

Uh oh!

github-actions Bot commented Apr 28, 2026

Smoke Test

Uh oh!

github-actions Bot commented Apr 28, 2026

Smoke Test Results

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Apr 28, 2026 •

edited

Loading

github-actions Bot commented Apr 28, 2026 •

edited

Loading