fix: AWF_ENABLE_HOST_ACCESS safety net sets '1' instead of 'true' by lpcox · Pull Request #2227 · github/gh-aw-firewall

lpcox · 2026-04-27T00:32:26Z

Problem

The allowHostServicePorts safety net in docker-manager.ts (line 1070) was setting:

environment.AWF_ENABLE_HOST_ACCESS = 'true';

But containers/agent/entrypoint.sh:567 checks:

if [ "${AWF_ENABLE_HOST_ACCESS}" = "1" ]; then

This mismatch meant host access features silently failed when allowHostServicePorts was set without explicit enableHostAccess.

Fix

Changed 'true' → '1' to match the convention used everywhere else (the primary path at line 1603, setup-iptables.sh, and entrypoint.sh).

Testing

Added test: should set AWF_ENABLE_HOST_ACCESS to 1 via safety net when allowHostServicePorts is set without enableHostAccess
All 383 existing tests pass (4 pre-existing failures unrelated to this change)

Fixes #1728

The allowHostServicePorts safety net in docker-manager.ts was setting AWF_ENABLE_HOST_ACCESS='true', but entrypoint.sh checks for '1'. This caused host access features to silently fail when allowHostServicePorts was set without explicit enableHostAccess. Fixes #1728 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Fixes a mismatch between how AWF_ENABLE_HOST_ACCESS was being set in the TypeScript “safety net” path and how it’s checked in the agent container scripts, which could cause host access features to silently not activate when allowHostServicePorts is used programmatically.

Changes:

Update the allowHostServicePorts safety net to set AWF_ENABLE_HOST_ACCESS to '1' (instead of 'true') for consistency with container-side checks.
Add a unit test covering the safety-net behavior when allowHostServicePorts is set without enableHostAccess.

Show a summary per file

File	Description
src/docker-manager.ts	Aligns `AWF_ENABLE_HOST_ACCESS` safety-net value with shell scripts expecting `"1"`.
src/docker-manager.test.ts	Adds regression test ensuring the safety net sets `AWF_ENABLE_HOST_ACCESS` when `allowHostServicePorts` is provided without `enableHostAccess`.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 2/2 changed files
Comments generated: 0

github-actions · 2026-04-27T00:34:40Z

Smoke Test Results

✅ GitHub MCP: Retrieved last 2 merged PRs
✅ Playwright: Page title verified at github.com
✅ File Writing: Test file created with timestamp
✅ Bash Tool: File verified via cat

Overall: PASS

💥 [THE END] — Illustrated by Smoke Claude

github-actions · 2026-04-27T00:35:34Z

chore: recompile all agentic workflows
feat: optimize Smoke Services workflow for token efficiency
GitHub MCP ❌
safeinputs-gh ❌
Playwright ✅
Tavily ❌
File write/bash ✅
Discussion ✅
Build ✅
Overall: FAIL

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex

github-actions · 2026-04-27T00:36:02Z

Smoke Test Results

Redis PING: ❌ (timeout — no response from host.docker.internal:6379)
PostgreSQL pg_isready: ❌ (no response from host.docker.internal:5432)
PostgreSQL SELECT 1: ❌ (skipped — pg unreachable)

Overall: FAIL — host.docker.internal is not routing to service containers in this environment.

🔌 Service connectivity validated by Smoke Services

github-actions · 2026-04-27T00:36:26Z

Chroot Version Comparison Results

Runtime	Host Version	Chroot Version	Match?
Python	Python 3.12.13	Python 3.12.3	❌
Node.js	v24.14.1	v20.20.2	❌
Go	go1.22.12	go1.22.12	✅

Overall: ❌ Not all tests passed — Python and Node.js versions differ between host and chroot environments.

Tested by Smoke Chroot

github-actions · 2026-04-27T00:36:32Z

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A	✅ PASS
.NET	json-parse	✅	N/A	✅ PASS
Go	color	✅	ok	✅ PASS
Go	env	✅	ok	✅ PASS
Go	uuid	✅	ok	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	All passed	✅ PASS
Node.js	execa	✅	All passed	✅ PASS
Node.js	p-limit	✅	All passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — ✅ PASS

Generated by Build Test Suite for issue #2227 · ● 431.7K · ◷

github-actions · 2026-04-27T01:07:04Z

🔬 Smoke Test Results

✅ GitHub MCP: PR fix: AWF_ENABLE_HOST_ACCESS safety net sets '1' instead of 'true' #2227 — "fix: AWF_ENABLE_HOST_ACCESS safety net sets '1' instead of 'true'"
✅ GitHub.com connectivity: HTTP 200
✅ File write/read: Smoke test file exists and readable

Overall: PASS

PR by @lpcox · Reviewer: @Mossaka

📰 BREAKING: Report filed by Smoke Copilot

github-actions · 2026-04-27T01:13:48Z

Smoke Test: Copilot BYOK (Offline) Mode — Run #24971929239

Test	Result
GitHub MCP (list PRs)	✅
GitHub.com connectivity	✅
File write/read	✅ (`BYOK smoke test passed at Mon Apr 27 01:12:31 UTC 2026`)
BYOK inference (api-proxy → api.githubcopilot.com)	✅

Running in BYOK offline mode (COPILOT_OFFLINE=true) via api-proxy → api.githubcopilot.com
Author: @lpcox | Reviewer: @Mossaka

Overall: PASS

🔑 BYOK report filed by Smoke Copilot BYOK

Copilot AI review requested due to automatic review settings April 27, 2026 00:32

lpcox requested a review from Mossaka as a code owner April 27, 2026 00:32

Copilot started reviewing on behalf of lpcox April 27, 2026 00:32 View session

Copilot AI reviewed Apr 27, 2026

View reviewed changes

github-actions Bot added the smoke-claude label Apr 27, 2026

This comment has been minimized.

Sign in to view

github-actions Bot added the smoke-copilot-byok label Apr 27, 2026

github-actions Bot mentioned this pull request Apr 27, 2026

[aw] No-Op Runs #2151

Closed

github-actions Bot added the build-test label Apr 27, 2026

lpcox merged commit 4cd4edc into main Apr 27, 2026
67 of 72 checks passed

lpcox deleted the fix/host-access-env-mismatch branch April 27, 2026 00:50

github-actions Bot added the smoke-copilot label Apr 27, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: AWF_ENABLE_HOST_ACCESS safety net sets '1' instead of 'true'#2227

fix: AWF_ENABLE_HOST_ACCESS safety net sets '1' instead of 'true'#2227
lpcox merged 1 commit intomainfrom
fix/host-access-env-mismatch

lpcox commented Apr 27, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

github-actions Bot commented Apr 27, 2026

Uh oh!

This comment has been minimized.

This comment has been minimized.

github-actions Bot commented Apr 27, 2026

Uh oh!

github-actions Bot commented Apr 27, 2026

Uh oh!

github-actions Bot commented Apr 27, 2026

Uh oh!

github-actions Bot commented Apr 27, 2026

Uh oh!

Uh oh!

github-actions Bot commented Apr 27, 2026

Uh oh!

github-actions Bot commented Apr 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

lpcox commented Apr 27, 2026

Problem

Fix

Testing

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

github-actions Bot commented Apr 27, 2026

Uh oh!

This comment has been minimized.

This comment has been minimized.

github-actions Bot commented Apr 27, 2026

Uh oh!

github-actions Bot commented Apr 27, 2026

Smoke Test Results

Uh oh!

github-actions Bot commented Apr 27, 2026

Chroot Version Comparison Results

Uh oh!

github-actions Bot commented Apr 27, 2026

🏗️ Build Test Suite Results

Uh oh!

Uh oh!

github-actions Bot commented Apr 27, 2026

🔬 Smoke Test Results

Uh oh!

github-actions Bot commented Apr 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants