Refactor API proxy request path into focused guard and transport modules by Copilot · Pull Request #3159 · github/gh-aw-firewall

Copilot · 2026-05-14T15:59:19Z

✨ Enhancement

containers/api-proxy/proxy-request.js had grown into a 1,196-line mixed-responsibility module (guards, steering, body mutation, rate limiting, HTTP, WebSocket) in a security-critical credential injection path. This change decomposes those concerns into focused modules while preserving the existing proxy-request public API for callers.

What does this improve?

Reduces cognitive load and review surface in the proxy hot path.
Isolates stateful guard logic from transport code, making future changes more localized.

Why is this valuable?

Lowers risk when modifying security-sensitive forwarding behavior.
Makes guard behavior (max-runs, effective-token, timeout steering) independently evolvable without reworking HTTP/WebSocket plumbing.

Implementation approach:

Guard extraction
- containers/api-proxy/guards/max-runs-guard.js
- containers/api-proxy/guards/effective-token-guard.js
- containers/api-proxy/guards/timeout-steering.js
Utility extraction
- containers/api-proxy/body-transform.js for body sanitization and steering-message injection.
- containers/api-proxy/rate-limit.js for rate-limit response handling via an injected checker factory.
Transport extraction
- containers/api-proxy/websocket-proxy.js for WebSocket tunneling logic.
Composition root
- containers/api-proxy/proxy-request.js now composes the extracted modules and retains existing exports used by server.js and tests.

const { sanitizeNullToolCallTypes, injectSteeringMessage } = require('./body-transform');
const { createRateLimitChecker } = require('./rate-limit');
const { createProxyWebSocket } = require('./websocket-proxy');
const { applyEffectiveTokenUsage, getEffectiveTokenBlockState } = require('./guards/effective-token-guard');
const { applyMaxRunsInvocation, getMaxRunsBlockState } = require('./guards/max-runs-guard');

const checkRateLimit = createRateLimitChecker({ limiter, metrics, logRequest, generateRequestId, isValidRequestId });
const proxyWebSocket = createProxyWebSocket({ /* injected deps */ });

Copilot

Pull request overview

This PR refactors the API proxy request path by extracting guard logic, body transformations, rate limiting, and WebSocket transport into focused modules while keeping proxy-request.js as the composition/root export surface.

Changes:

Extracts effective-token, max-runs, and timeout-steering guards.
Moves body mutation and rate-limit response handling into reusable modules.
Moves WebSocket tunneling logic into a dedicated transport module.

Show a summary per file

File	Description
`containers/api-proxy/proxy-request.js`	Composes the extracted modules and preserves shared exports.
`containers/api-proxy/body-transform.js`	Contains request-body sanitization and steering-message injection helpers.
`containers/api-proxy/rate-limit.js`	Provides a factory for rate-limit checks and 429 responses.
`containers/api-proxy/websocket-proxy.js`	Contains WebSocket upgrade validation and tunneling behavior.
`containers/api-proxy/guards/effective-token-guard.js`	Manages effective-token accounting, limits, and token steering state.
`containers/api-proxy/guards/max-runs-guard.js`	Manages max-runs accounting and limit responses.
`containers/api-proxy/guards/timeout-steering.js`	Manages timeout-based steering warnings.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 7/7 changed files
Comments generated: 1

+const { sanitizeNullToolCallTypes, injectSteeringMessage } = require('./body-transform');
+const { createRateLimitChecker } = require('./rate-limit');
+const { createProxyWebSocket } = require('./websocket-proxy');


lpcox · 2026-05-14T16:47:27Z

@copilot address review feedback and fix this failing ci check https://github.com/github/gh-aw-firewall/actions/runs/25870995854/job/76028886971?pr=3159

Copilot · 2026-05-14T16:52:51Z

@copilot address review feedback and fix this failing ci check https://github.com/github/gh-aw-firewall/actions/runs/25870995854/job/76028886971?pr=3159

Fixed in commit 1757075.

I updated containers/api-proxy/Dockerfile to copy the extracted modules (body-transform.js, rate-limit.js, websocket-proxy.js) and guards/, which resolves the CI failure from job 76028886971 (Cannot find module './body-transform' in the awf-api-proxy container).

github-actions · 2026-05-14T17:27:57Z

Claude Engine Validation - Smoke Test Results

Test	Result
GitHub API (list merged PRs)	❌ FAILED - gh auth issue (HTTP 401)
Playwright (navigate github.com)	✅ PASSED - title contains "GitHub"
File verify (smoke-test-claude-*.txt)	✅ PASSED - file exists with valid content

Summary: 2/3 PASSED - One test failed due to GitHub API authentication issue in the proxy environment.

💥 [THE END] — Illustrated by Smoke Claude

github-actions · 2026-05-14T17:28:33Z

Smoke Test Results

Test	Status
GitHub MCP connectivity	❌ (401 Bad credentials)
GitHub.com HTTP connectivity	❌ (template vars not interpolated)
File write/read	❌ (template vars not interpolated)

Overall: FAIL

The pre-step template variables (${{ steps.smoke-data.outputs.* }}) were not substituted, indicating the smoke-data step did not run or output was not passed to this step. GitHub MCP returned 401 Bad credentials.

📰 BREAKING: Report filed by Smoke Copilot

github-actions · 2026-05-14T17:29:16Z

Smoke Test: Copilot BYOK (Offline) Mode

Test	Status
GitHub MCP connectivity	✅
GitHub.com HTTP connectivity	✅ (pre-step passed)
File write/read (`smoke-test-copilot-byok-25873144391.txt`)	✅
BYOK inference (agent → api-proxy → api.githubcopilot.com)	✅

Running in BYOK offline mode (COPILOT_OFFLINE=true) via api-proxy → api.githubcopilot.com

Overall: PASS

🔑 BYOK report filed by Smoke Copilot BYOK

github-actions · 2026-05-14T17:29:27Z

Codex Smoke Test

PRs: fix: remove dead re-exports of WrapperConfig component types; fix(entrypoint): preserve setup-* PATH ordering in fallback hostedtoolcache scan
✅ GitHub PR review via public REST; ❌ safeinputs-gh unavailable; ✅ Playwright title; ❌ Tavily unavailable
✅ File write/read; ❌ discussion query unavailable/skipped; ✅ npm ci && npm run build
Overall status: FAIL

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex

github-actions · 2026-05-14T17:29:42Z

Gemini Smoke Test Results

GitHub MCP Testing: ❌ (Tools not found)
GitHub.com Connectivity: ❌ (SSL error 35)
File Writing Testing: ✅
Bash Tool Testing: ✅

Overall Status: FAIL

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

localhost

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "localhost"

See Network Configuration for more information.

💎 Faceted by Smoke Gemini

github-actions · 2026-05-14T17:30:00Z

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A	✅ PASS
.NET	json-parse	✅	N/A	✅ PASS
Go	color	✅	1/1 passed	✅ PASS
Go	env	✅	1/1 passed	✅ PASS
Go	uuid	✅	1/1 passed	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	All passed	✅ PASS
Node.js	execa	✅	All passed	✅ PASS
Node.js	p-limit	✅	All passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — ✅ PASS

Note (Java): Maven's default local repo (~/.m2/repository) was not writable due to directory ownership. Tests were run with -Dmaven.repo.local=/tmp/gh-aw/agent/m2repo as a workaround; all tests passed successfully.

Generated by Build Test Suite for issue #3159 · ● 4M · ◷

github-actions · 2026-05-14T17:30:06Z

Chroot Smoke Test Results

Runtime	Host Version	Chroot Version	Match?
Python	Python 3.12.13	Python 3.12.3	❌
Node.js	v24.14.1	v20.20.2	❌
Go	go1.22.12	go1.22.12	✅

Overall: ❌ Not all versions match — Python and Node.js differ between host and chroot environments.

Tested by Smoke Chroot

github-actions · 2026-05-14T17:30:54Z

Smoke Test: GitHub Actions Services Connectivity

Check	Result
Redis PING	❌ Timeout/No response
PostgreSQL pg_isready	❌ No response
PostgreSQL SELECT 1	❌ Timeout/No response

Overall: FAIL — host.docker.internal is unreachable from this environment. Service containers are not accessible.

🔌 Service connectivity validated by Smoke Services

Initial plan

7ee6c41

Copilot AI assigned Copilot and lpcox May 14, 2026

Copilot started work on behalf of lpcox May 14, 2026 15:59 View session

Copilot AI linked an issue May 14, 2026 that may be closed by this pull request

[Refactoring] Split containers/api-proxy/proxy-request.js into focused modules #3154

Closed

refactor: split api-proxy proxy-request modules

dc1c22d

Copilot AI changed the title ~~[WIP] Refactor proxy request file into multiple modules~~ Refactor API proxy request path into focused guard and transport modules May 14, 2026

Copilot finished work on behalf of lpcox May 14, 2026 16:09

Copilot AI requested a review from lpcox May 14, 2026 16:09

lpcox marked this pull request as ready for review May 14, 2026 16:26

lpcox requested a review from Mossaka as a code owner May 14, 2026 16:26

Copilot AI review requested due to automatic review settings May 14, 2026 16:26

Copilot started reviewing on behalf of lpcox May 14, 2026 16:27 View session

This comment has been minimized.

Sign in to view

github-actions Bot mentioned this pull request May 14, 2026

[aw] No-Op Runs #2911

Open

This comment has been minimized.

Sign in to view

github-actions Bot added the build-test label May 14, 2026

This comment has been minimized.

Sign in to view

Copilot AI reviewed May 14, 2026

View reviewed changes

Comment thread containers/api-proxy/proxy-request.js

Comment on lines +16 to +18

const { sanitizeNullToolCallTypes, injectSteeringMessage } = require('./body-transform');

const { createRateLimitChecker } = require('./rate-limit');

const { createProxyWebSocket } = require('./websocket-proxy');

This comment has been minimized.

Sign in to view

Copilot started work on behalf of lpcox May 14, 2026 16:47 View session

fix: include extracted api-proxy modules in Docker image

1757075

Copilot finished work on behalf of lpcox May 14, 2026 16:53

github-actions Bot added the smoke-copilot-byok label May 14, 2026

github-actions Bot mentioned this pull request May 14, 2026

[aw] Security Guard failed #3164

Closed

lpcox merged commit cf1a4a2 into main May 14, 2026
63 of 68 checks passed

lpcox deleted the copilot/refactor-api-proxy-modules branch May 14, 2026 17:42

Conversation

Copilot AI commented May 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✨ Enhancement

Uh oh!

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

This comment has been minimized.

This comment has been minimized.

lpcox commented May 14, 2026

Uh oh!

Copilot AI commented May 14, 2026

Uh oh!

github-actions Bot commented May 14, 2026

Claude Engine Validation - Smoke Test Results

Uh oh!

github-actions Bot commented May 14, 2026

Smoke Test Results

Uh oh!

github-actions Bot commented May 14, 2026

Smoke Test: Copilot BYOK (Offline) Mode

Uh oh!

github-actions Bot commented May 14, 2026

Codex Smoke Test

Uh oh!

github-actions Bot commented May 14, 2026

Gemini Smoke Test Results

Uh oh!

github-actions Bot commented May 14, 2026

🏗️ Build Test Suite Results

Uh oh!

github-actions Bot commented May 14, 2026

Chroot Smoke Test Results

Uh oh!

github-actions Bot commented May 14, 2026

Smoke Test: GitHub Actions Services Connectivity

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented May 14, 2026 •

edited

Loading