fix(api-proxy): honor configured providers in model steering

[Copilot]

• Filter model-alias candidates against actually-configured provider slots before resolution/advertisement
• Make provider_not_configured non-retryable (HTTP 403, retryable: false); keep 503/retryable only for transient OIDC states
• Document apiProxy.enableTokenSteering opt-out and the new alias-filtering behavior
• Add focused unit tests (filterAvailableModelsToConfiguredProviders, steering repro, retryable OIDC case)
• api-proxy suite green (78 suites / 1558 tests); npm run build + npm run lint clean

• Fixes [awf] api-proxy: token steering silently overrides explicit provider/model config, routes to unconfigured provider #6912

[Copilot]

Pull request overview

Prevents API-proxy model aliases from steering requests toward unconfigured providers and makes configuration failures fail fast.

Changes:

• Filters alias candidates using configured provider slots.
• Returns non-retryable HTTP 403 errors for missing providers while retaining retryable OIDC responses.
• Documents token-steering opt-out and adds focused tests.

Show a summary per file

File	Description
src/awf-config-schema.json	Clarifies token-steering configuration.
docs/awf-config.schema.json	Updates published schema documentation.
docs/awf-config-spec.md	Documents filtering, opt-out, and error semantics.
docs/api-proxy-sidecar.md	Documents explicit steering opt-out.
containers/api-proxy/server.routing.test.js	Tests provider error responses.
containers/api-proxy/server.lifecycle.test.js	Updates adapter lifecycle expectations.
containers/api-proxy/server.js	Applies provider filtering to routing and advertisement.
containers/api-proxy/proxy-utils.js	Adds retryability-aware error construction.
containers/api-proxy/providers/copilot.js	Marks pending OIDC tokens retryable.
containers/api-proxy/model-resolver.test.js	Tests configured-provider filtering.
containers/api-proxy/model-resolver.js	Implements provider model filtering.
containers/api-proxy/model-config.js	Integrates filtering into model rewriting.
containers/api-proxy/copilot-adapter-enterprise.test.js	Verifies transient OIDC behavior.
containers/api-proxy/adapter-factory.test.js	Updates default error expectations.
containers/api-proxy/adapter-factory.js	Propagates retryability metadata.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 15/15 changed files
• Comments generated: 3
• Review effort level: Balanced

[lpcox]

@copilot address review feedback

[github-actions]

✅ Copilot review passed with no inline comments.

@copilot Add the ready-for-aw label to this PR to trigger agentic CI smoke tests.

[github-actions]

Documentation Preview

Documentation build failed for this PR. View logs.

Built from commit f07481d

[github-actions]

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	98.87%	98.89%	📈 +0.02%
Statements	98.75%	98.78%	📈 +0.03%
Functions	99.10%	99.10%	➡️ +0.00%
Branches	94.97%	94.97%	➡️ +0.00%

📁 Per-file Coverage Changes (1 files)

File	Lines (Before → After)	Statements (Before → After)
src/log-directory-setup.ts	96.2% → 100.0% (+3.78%)	96.3% → 100.0% (+3.71%)

---

Coverage comparison generated by scripts/ci/compare-coverage.ts

[github-actions]

✅ Smoke Claude passed

[github-actions]

❌ Smoke Copilot BYOK AOAI (api-key) reports failed. AOAI BYOK (api-key) mode investigation needed...

[github-actions]

🔌 Smoke Services — All services reachable! ✅

[github-actions]

✅ Security Guard completed successfully!

Security review complete for PR #6963. No security vulnerabilities found. Changes improve provider configuration validation and fix retry behavior for unconfigured providers (403 + retryable:false prevents loops). All firewall rules, capabilities, domain allowlists, and input validation remain unchanged. OIDC logic correction improves correctness without security regression.

[github-actions]

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

[github-actions]

📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅

[github-actions]

❌ Contribution Check failed. Please review the logs for details.

[github-actions]

Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded.

[github-actions]

📰 VERDICT: Smoke Docker Sbx has concluded. All systems operational. This is a developing story. 🎤

[github-actions]

✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓

[github-actions]

❌ Smoke Copilot BYOK AOAI (Entra) reports failed. AOAI BYOK (Entra) mode investigation needed...

[github-actions]

✅ Build Test Suite completed successfully!

[github-actions]

✅ Smoke Gemini completed. All facets verified. 💎

[github-actions]

🛡️ Smoke Copilot Network Isolation confirmed the egress allowlist is enforced. ✅

[github-actions]

Smoke Test: Claude Engine Validation

Check	Result
API status	✅ PASS
gh check	✅ PASS
File status	✅ PASS

Overall result: PASS ✅

Generated by Smoke Claude for #6963 · haiku45 · 55.8 AIC · ⊞ 3.6K · ◷
_{Add label ready-for-aw to run again}

[github-actions]

Smoke Test: Services Connectivity

• Redis: ❌ (Temporary failure in name resolution)
• PostgreSQL pg_isready: ❌ (no response)
• PostgreSQL SELECT 1: ❌ (could not translate host name)

Overall: FAIL — host.docker.internal did not resolve; sandbox could not reach host service containers.

🔌 Service connectivity validated by Smoke Services
_{Add label ready-for-aw to run again}

[github-actions]

Smoke Test: Copilot BYOK (Direct) Mode

@lpcox

• ✅ GitHub MCP: PR Upgrade gh-aw to v0.85.0 pre-release and recompile workflows #6957 (Upgrade gh-aw to v0.85.0...), PR chore: update model-to-API mapping (2026-08-05) #6951 (chore: update model-to-API mapping...)
• ✅ GitHub.com connectivity (HTTP 200)
• ✅ File write/read test
• ✅ BYOK inference (agent → api-proxy → api.githubcopilot.com)

Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY) via api-proxy → api.githubcopilot.com

Overall: PASS

🔑 BYOK report filed by Smoke Copilot BYOK
_{Add label ready-for-aw to run again}

[github-actions]

Smoke Test: Copilot Engine — @lpcox

• ✅ GitHub MCP: PR Upgrade gh-aw to v0.85.0 pre-release and recompile workflows #6957 "Upgrade gh-aw to v0.85.0 pre-release and recompile workflows"
• ✅ GitHub.com connectivity (HTTP 200)
• ✅ File write/read test

Overall: PASS

📰 BREAKING: Report filed by Smoke Copilot
_{Add label ready-for-aw to run again}

[github-actions]

EGRESS_RESULT allow=pass deny=pass

✅ Allowed domain (github.com) reachable: allowed=200
✅ Blocked domain (example.com) denied: CONNECT tunnel failed 403

Overall status: PASS

cc @lpcox

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• example.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "example.com"

See Network Configuration for more information.

🛡️ Egress verdict from Smoke Copilot Network Isolation
_{Add label ready-for-aw to run again}

[github-actions]

📡 OTel Tracing Smoke Test Results

• ✅ Scenario 1 (Module Loading): otel.js loaded successfully, isEnabled() returned true, exports include startRequestSpan, setTokenAttributes, setBudgetAttributes, endSpan, shutdown, etc.
• ✅ Scenario 2 (Test Suite): 3 test suites / 68 tests passed (otel.test.js, otel-workload-identity.test.js, otel-fanout.test.js).
• ✅ Scenario 3 (Env Var Forwarding): env-passthrough.ts forwards GITHUB_AW_OTEL_TRACE_ID/GITHUB_AW_OTEL_PARENT_SPAN_ID; api-proxy-env-config.ts forwards GH_AW_OTLP_ENDPOINTS, OTEL_EXPORTER_OTLP_ENDPOINT, and trace context vars.
• ✅ Scenario 4 (Token Tracker Integration): token-tracker-http.js contains the onUsage callback hook point used by OTEL.
• i️ Scenario 5 (OTEL Diagnostics): No otel.jsonl span file present in this run (no live LLM traffic was proxied through api-proxy during this smoke test), so no spans were exported — expected for a validation-only run.

Summary: All checkable scenarios passed. No regressions detected.

📡 OTel tracing validated by Smoke OTel Tracing
_{Add label ready-for-aw to run again}

[github-actions]

Chroot Version Comparison

Runtime	Host Version	Chroot Version	Match?
Python	Python 3.12.13	Python 3.12.13	✅ YES
Node.js	v24.18.0	v22.23.1	❌ NO
Go	go1.22.12	go1.22.12	✅ YES

Overall result: ❌ Not all tests passed — Node.js version differs between host and chroot environment (v24.18.0 vs v22.23.1). smoke-chroot label not added.

Tested by Smoke Chroot
_{Add label ready-for-aw to run again}

[github-actions]

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A (run OK)	✅ PASS
.NET	json-parse	✅	N/A (run OK)	✅ PASS
Go	color	✅	ok (1 pkg)	✅ PASS
Go	env	✅	ok (1 pkg)	✅ PASS
Go	uuid	✅	ok (1 pkg)	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	passed	✅ PASS
Node.js	execa	✅	passed	✅ PASS
Node.js	p-limit	✅	passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — ✅ PASS

All 18 projects across Bun, C++, Deno, .NET, Go, Java, Node.js, and Rust built/installed and tested successfully. No errors encountered. All repositories cloned successfully.

Note: Java builds required setting localRepository to a writable path (/tmp/gh-aw/agent/m2-repo) in ~/.m2/settings.xml, since the default ~/.m2 directory was not writable by the runner user in this environment — this was a local runner permission quirk, not a firewall/proxy issue.

Generated by Build Test Suite for #6963 · auto · 55.9 AIC · ⊞ 11.7K · ◷
_{Add label ready-for-aw to run again}

[github-actions]

Merged PRs:

• Upgrade gh-aw to v0.85.0 pre-release and recompile workflows
• chore: update model-to-API mapping (2026-08-05)

Tests:

• GitHub MCP Testing: ✅
• Safe Inputs GH CLI Testing: ❌ (safeinputs-gh unavailable)
• Playwright Testing: ✅
• File Writing Testing: ✅
• Bash Tool Testing: ✅
• Discussion Interaction Testing: ❌ (gh api found discussion CI/CD Pipeline and Integration Test Coverage Assessment #191; comments disabled here)
• Build AWF: ❌ (npm ci hit 403 on yocto-queue)

Overall: FAIL

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

[github-actions]

Docker Sbx Smoke Test — PR #6963 (author/assignees: cc as applicable)

• ✅ MCP connectivity (list_pull_requests succeeded; pre-fetched: Upgrade gh-aw to v0.85.0 pre-release and recompile workflows #6957, chore: update model-to-API mapping (2026-08-05) #6951)
• ✅ GitHub.com connectivity (HTTP 200)
• ✅ File write/read (smoke-test-docker-sbx-31023929263.txt)

Overall: PASS

📰 BREAKING: Report filed by Smoke Docker Sbx
_{Add label ready-for-aw to run again}

[github-actions]

Gemini Smoke Test Results

• PR refactor: share sbx ingress capability writer #6961: Filtered (Access Denied)
• PR refactor: share bounded preflight runtime probes #6960: Filtered (Access Denied)

1. GitHub MCP Testing: ❌ (Access Denied)
2. GitHub.com Connectivity: ❌ (000/No DNS)
3. File Writing Testing: ✅
4. Bash Tool Testing: ✅

Overall status: FAIL

💎 Faceted by Smoke Gemini
_{Add label ready-for-aw to run again}