Deduplicate API proxy config env lookup and auth type normalization

[Copilot]

The API proxy split left two sibling service modules with byte-for-byte copies of getConfigEnvValue, plus duplicated AWF_AUTH_TYPE normalization. This made env precedence changes easy to miss and kept auth-path logic duplicated across the credential and service config paths.

• Shared env/config helpers

  • Moved getConfigEnvValue into src/env-utils.ts
  • Added shared normalization helpers for trimmed env values and lowercased process env reads
  • Kept the existing precedence intact: additionalEnv -> envFile -> process.env (when envAll)

• API proxy services

  • Removed the private getConfigEnvValue copies from:
    • src/services/api-proxy-credential-env.ts
    • src/services/api-proxy-service-config.ts
  • Switched both modules to the shared helpers
  • Replaced duplicated AWF_AUTH_TYPE normalization with the shared lowercasing helper
  • Also reused the same helper for AWF_AUTH_PROVIDER normalization in the credential path

• Focused coverage

  • Added unit coverage for:
    • config env precedence and trimming
    • envAll-gated fallback to process.env
    • lowercased process env normalization

Example of the shared lookup now used by both code paths:

export function getConfigEnvValue(config: WrapperConfig, key: string): string | undefined {
  const envFileValue = config.envFile
    ? readEnvFile(config.envFile)[key]
    : undefined;

  const value =
    config.additionalEnv?.[key] ??
    envFileValue ??
    (config.envAll ? process.env[key] : undefined);

  return normalizeEnvValue(value);
}

[github-actions]

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	96.59%	96.63%	📈 +0.04%
Statements	96.50%	96.54%	📈 +0.04%
Functions	98.71%	98.71%	➡️ +0.00%
Branches	90.86%	90.86%	➡️ +0.00%

📁 Per-file Coverage Changes (1 files)

File	Lines (Before → After)	Statements (Before → After)
src/config-writer.ts	89.3% → 90.9% (+1.65%)	89.3% → 90.9% (+1.65%)

---

Coverage comparison generated by scripts/ci/compare-coverage.ts

[github-actions]

Smoke Test: Claude Engine

• ✅ GitHub API: 2 recent PRs fetched (refactor(test): deduplicate TLS tunnel mock setup in websocket tests #4330, Move tool cache mount detection into AWF and add stdin config schema support #4329)
• ✅ GitHub check: playwright_check PASS
• ✅ File verify: smoke-test-claude-26985549621.txt present

Result: PASS

💥 [THE END] — Illustrated by Smoke Claude

[Copilot]

Pull request overview

This PR refactors API-proxy-related environment/config lookups by centralizing duplicated config/env precedence logic and auth-type normalization into src/env-utils.ts, then updating the two API proxy service modules to reuse those helpers. It also expands unit tests to cover the shared helpers’ precedence, trimming, envAll gating, and lowercasing behavior.

Changes:

• Moved duplicated getConfigEnvValue logic into src/env-utils.ts and added shared normalization helpers.
• Updated API proxy service config and credential env modules to use the shared helpers (including normalized AWF_AUTH_TYPE / AWF_AUTH_PROVIDER reads).
• Added unit tests covering config env precedence/trimming and lowercased process env normalization.

Show a summary per file

File	Description
src/services/api-proxy-service-config.ts	Removes local env lookup + normalizes auth type via shared helpers.
src/services/api-proxy-credential-env.ts	Removes local env lookup + normalizes auth type/provider via shared helpers.
src/env-utils.ts	Adds shared env value normalization and config/env precedence helper functions.
src/env-utils.test.ts	Adds focused unit coverage for new env-utils helpers (precedence, trimming, envAll gating, lowercasing).

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 4/4 changed files
• Comments generated: 0

[github-actions]

🤖 Smoke Test Results — run 26985549659

Test	Result
GitHub MCP connectivity	✅
GitHub.com HTTP	✅
File write/read	✅

Overall: PASS

PR: Deduplicate API proxy config env lookup and auth type normalization — author @Copilot, assignees @lpcox @Copilot

📰 BREAKING: Report filed by Smoke Copilot

[github-actions]

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex

[github-actions]

🔑 Smoke Test: Copilot BYOK (Direct) — PASS

Test	Result
GitHub MCP connectivity	✅
GitHub.com connectivity	✅
File write/read	✅ (smoke-test-copilot-byok-26985549642.txt)
BYOK inference	✅

PR: Deduplicate API proxy config env lookup and auth type normalization — @Copilot (assignees: @lpcox, @Copilot)

Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY) via api-proxy → api.githubcopilot.com

🔑 BYOK report filed by Smoke Copilot BYOK

[github-actions]

🧪 Chroot Smoke Test Results

Runtime	Host Version	Chroot Version	Match?
Python	Python 3.12.13	Python 3.12.3	❌
Node.js	v24.16.0	v22.22.3	❌
Go	go1.22.12	go1.22.12	✅

Overall: ❌ FAILED — Python and Node.js versions differ between host and chroot environments.

Tested by Smoke Chroot

[github-actions]

Gemini Smoke Test: FAIL (Connectivity 400/35, MCP missing, FS/Bash OK)

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• localhost

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "localhost"

See Network Configuration for more information.

💎 Faceted by Smoke Gemini

[github-actions]

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A	✅ PASS
.NET	json-parse	✅	N/A	✅ PASS
Go	color	✅	1/1 passed	✅ PASS
Go	env	✅	1/1 passed	✅ PASS
Go	uuid	✅	1/1 passed	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	All passed	✅ PASS
Node.js	execa	✅	All passed	✅ PASS
Node.js	p-limit	✅	All passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — ✅ PASS

Generated by Build Test Suite for issue #4338 · sonnet46 1.1M · ◷

[github-actions]

Smoke Test Results

Check	Result
Redis PING	❌ timeout
PostgreSQL pg_isready	❌ no response
PostgreSQL SELECT 1	❌ timeout expired

host.docker.internal resolves to 172.17.0.1 but services are unreachable on ports 6379 and 5432.

Overall: FAIL

🔌 Service connectivity validated by Smoke Services