Surface AWF startup failures in firewall summaries#8023
Conversation
There was a problem hiding this comment.
🟡 Changes recommended
Diagnostic persistence currently has symlink-safety, sensitive-data, lifecycle, coverage, and phase-classification defects.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
Adds persisted, redacted startup-failure diagnostics to firewall summaries when Squid produces no access log.
Changes:
- Records startup failures in
awf-startup-error.json. - Discovers and aggregates diagnostic-only log sources.
- Displays diagnostics in JSON, Markdown, and terminal summaries.
File summaries
| File | Description |
|---|---|
src/types/logging.ts |
Defines startup diagnostic data. |
src/types/index.ts |
Exports the diagnostic type. |
src/logs/startup-diagnostics.ts |
Locates and reads diagnostic files. |
src/logs/log-discovery.ts |
Discovers diagnostic-only sources. |
src/logs/log-discovery.test.ts |
Tests diagnostic discovery. |
src/logs/log-aggregator.ts |
Adds diagnostics to aggregated statistics. |
src/logs/log-aggregator.test.ts |
Tests diagnostic aggregation. |
src/logs/stats-formatter.ts |
Formats diagnostics in all outputs. |
src/logs/stats-formatter.test.ts |
Tests diagnostic formatting. |
src/commands/main-action.ts |
Writes diagnostics on failures. |
src/commands/main-action.test.ts |
Tests writing and basic redaction. |
Review details
Suppressed comments (4)
src/commands/main-action.ts:111
redactSecrets()does not redact secret-derived API target hosts fromconfig.sensitiveAllowedDomains, so an exception mentioning a private base URL can leak it into this world-readable diagnostic artifact. ApplyderiveSensitiveEndpointForms(config.sensitiveAllowedDomains)andredactSensitiveValues()here asconfig-writer.ts:413-426does for other uploaded audit artifacts.
message: redactSecrets(message),
src/commands/main-action.ts:107
- The marker is only written on failure and is never cleared. If
--proxy-logs-diris reused, a later successful run retains the previousawf-startup-error.json;loadAndAggregate()then unconditionally reports that stale failure alongside the new run's access log. Remove the marker safely at the start of each run or associate diagnostics with a per-run directory/identifier.
fs.writeFileSync(
getStartupDiagnosticPath(proxyLogsDir),
src/commands/main-action.ts:438
- This catch covers the entire workflow, including
runAgentCommand()and cleanup afteronContainersStartedhas fired. Exceptions after the agent starts are therefore persisted with phasestartup, and markdown incorrectly says they occurred before Squid emittedaccess.log. Track the current phase or only write this marker from the pre-agent startup paths.
writeStartupFailureDiagnostic(config, error);
src/commands/main-action.ts:345
- The diagnostic catch begins only after
runDindBootstrap(config), which can reject during Docker staging or path validation. Those are startup aborts but still leave no marker, so the new summary path does not cover all promised pre-agent failures. Wrap the post-validation bootstrap sequence in the same diagnostic handling or move it inside this guarded startup flow.
writeStartupFailureDiagnostic(config, error);
- Files reviewed: 11/11 changed files
- Comments generated: 1
- Review effort level: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| const proxyLogsDir = config.proxyLogsDir || path.join(config.workDir, 'squid-logs'); | ||
| fs.mkdirSync(proxyLogsDir, { recursive: true, mode: 0o755 }); | ||
| const message = error instanceof Error ? error.message : String(error); | ||
| fs.writeFileSync( | ||
| getStartupDiagnosticPath(proxyLogsDir), |
|
@copilot address review feedback |
Addressed the review feedback in 1b3a283: startup diagnostic writes now validate the log directory, refuse symlink/non-regular marker targets, redact sensitive endpoint forms, and only record failures before the agent command begins. Added focused regression coverage. |
|
✅ Copilot review passed with no inline comments. @copilot Add the |
|
✅ Smoke Copilot BYOK AOAI (Entra) completed. Copilot AOAI BYOK (Entra) mode operational. 🔓
|
|
✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓
|
|
✅ Smoke Copilot BYOK AOAI (api-key) completed. Copilot AOAI BYOK (api-key) mode operational. 🔓
|
|
📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤
|
|
✅ Smoke Claude passed Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "api.anthropic.com"See Network Configuration for more information.
|
|
✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟 Warning Firewall blocked 7 domainsThe following domains were blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "accounts.google.com"
- "android.clients.google.com"
- "clients2.google.com"
- "contentautofill.googleapis.com"
- "msfeed25.pkgs.visualstudio.com"
- "www.google.com"
- "www.gstatic.com"See Network Configuration for more information.
|
|
📰 VERDICT: Smoke Docker Sbx has concluded. All systems operational. This is a developing story. 🎤
|
|
🚀 Security Guard has started processing this pull request |
|
❌ Smoke Gemini reports failed. Facets need polishing...
|
|
✅ Build Test Suite completed successfully!
|
|
📡 Smoke OTel Tracing reports failed. OTel tracing regression detected. OTEL Tracing Smoke Test — all scenarios passed:
|
|
Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded.
|
|
❌ Contribution Check failed. Please review the logs for details.
|
|
🔌 Smoke Services — All services reachable! ✅
|
|
🛡️ Smoke Copilot Network Isolation confirmed the egress allowlist is enforced. ✅ Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "example.com"See Network Configuration for more information.
|
Smoke Test: Claude Engine Validation
Overall result: PASS Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "api.anthropic.com"See Network Configuration for more information.
|
Smoke Test: Copilot BYOK (Direct) Mode ✅
Status: PASS — Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY)
|
|
Smoke Test: Copilot Engine —
Overall: PASS
|
|
EGRESS_RESULT allow=pass deny=pass ✅ Allowed domain (api.github.com) reachable — HTTP 200 Overall status: PASS cc Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "example.com"See Network Configuration for more information.
|
github-actions
Bot
added
the
smoke-copilot-network-isolation
|
Smoke Test: Docker Sbx —
Overall: PASS
|
Smoke Test: GitHub Actions Services Connectivity
Overall: FAIL
|
Chroot Version Comparison Results
|
|
|
|
Merged PRs: #8026 test: validate shared-gateway enclave smoke | #8021 Mount the configured container working directory when no other mount exposes it Warning Firewall blocked 7 domainsThe following domains were blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "accounts.google.com"
- "android.clients.google.com"
- "clients2.google.com"
- "contentautofill.googleapis.com"
- "msfeed25.pkgs.visualstudio.com"
- "www.google.com"
- "www.gstatic.com"See Network Configuration for more information.
|
|
test: validate shared-gateway enclave smoke: ✅
|
🏗️ Build Test Suite Results
Overall: 8/8 ecosystems passed — PASS Notes:
|
Codex workflows can fail before the agent starts, leaving no Squid
access.logand makingawf logs summaryreport only “no log sources found.” This adds a preserved startup diagnostic path for pre-egress failures.Startup diagnostics
awf-startup-error.jsoninto the proxy logs directory when AWF aborts during startup.Log discovery
awf-startup-error.jsonas valid log sources, even withoutaccess.log.AWF_LOGS_DIRand preserved/tmp/squid-logs-*discovery.Summary output
Example diagnostic surfaced by
awf logs summary:{ "startupDiagnostics": [ { "timestamp": "2026-09-02T12:45:57.000Z", "phase": "startup", "message": "Refusing to use symlink as bind mountpoint: /usr/local/bin/npm" } ] }