docs: Runner Doctor catalog update — B10 entrypoint fix, B13/B14/D10 new entries (2026-07-17–20 scan) by Copilot · Pull Request #6445 · github/gh-aw-firewall

Copilot · 2026-07-20T20:09:35Z

Syncs the Runner Doctor failure-mode catalog across all three mirrored files (shared/self-hosted-failure-modes.md, self-hosted-runner-doctor.md, .github/agents/self-hosted-runner-doctor.md) with four lessons from the 2026-07-17–20 scan.

Changes

B10 — second root cause added (PRs #6342/#6356)
Even after the @digest-stripping fix from #6025, the repair container was invoked without --entrypoint sh, so AWF's own entrypoint.sh ran instead of the chown/chmod command. entrypoint.sh waits ~30 s for an iptables-init container that never starts in this context, producing the same observable: three ~30 s timeouts. Fix: --entrypoint sh + -c, stdout captured alongside stderr.

B13 — new: topology peers and difcProxyHost denied through Squid in network-isolation mode (PRs #6189, #6438)
buildProxyEnvironment() omitted config.topologyAttach peer hostnames and config.difcProxyHost from NO_PROXY. Proxy-aware clients routed those hosts through Squid, which denied them (not in the allowlist). Fixed in two PRs: #6189 (topology peers), #6438 (DIFC proxy host).

B14 — new: Copilot CLI silent crash after ~/.copilot/config.json masked as credential (PR #6374)
The mount-policy refactor (#6339) incorrectly classified config.json (experiment flags, timestamps — no token) as a credential and overlaid it with a read-only /dev/null bind mount. The Copilot CLI atomically rewrites this file at startup via temp-file + rename; the read-only overlay makes the rename fail, producing an exit-1 crash with zero output. Does not affect sbx (which moves files aside rather than overlay-masking). Fixed in #6374.

D10 — new: rootless Copilot CLI not found in sbx PATH (PR #6407)
buildCoreEnvironment() injected a PATH without ~/.local/bin. sbx microVMs don't run entrypoint.sh (which adds it for compose runtimes), so binaries installed via --rootless were present but unreachable by name. Fixed by prepending ${HOME}/.local/bin in buildCoreEnvironment().

Error-string lookup additions

Three new rows added to the quick-lookup table in all three files:

Observable	Mode
Copilot CLI exits 1, ~0.5 s, zero output after AWF upgrade; sbx unaffected	B14
`copilot: command not found` in sbx microVM, binary at `~/.local/bin/copilot`	D10
`TCP_DENIED` in Squid log for topology peer or DIFC proxy host; MCP calls fail in network-isolation	B13

Fixes 🩺 Runner Doctor UpdateRunner Doctor catalog update — 2026-07-17 to 2026-07-20 scan (B10 repair entrypoint, Copilot config.json mask, sbx PATH, difcPro [Content truncated due to length] #6444

… (2026-07-17–20 scan)

Copilot

Pull request overview

Updates the mirrored Runner Doctor catalog with four recent AWF failure-mode lessons.

Changes:

Expands B10 with the repair-container entrypoint failure.
Adds B13, B14, and D10 diagnostics.
Adds corresponding quick-lookup entries.

Show a summary per file

File	Description
`.github/workflows/shared/self-hosted-failure-modes.md`	Updates the canonical failure catalog.
`.github/workflows/self-hosted-runner-doctor.md`	Updates the workflow doctor guidance.
`.github/agents/self-hosted-runner-doctor.md`	Updates the portable mirrored doctor.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 3/3 changed files
Comments generated: 9
Review effort level: Medium

+- Copilot CLI exits immediately (exit code 1, ~0.5 s, zero stdout/stderr) after AWF upgrade on Docker or gVisor but not sbx → B14 (`~/.copilot/config.json` incorrectly added to credential deny list; fixed in github/gh-aw-firewall#6374)
+- `copilot: command not found` inside `--container-runtime sbx` when binary is at `~/.local/bin/copilot` → D10 (`~/.local/bin` not included in sbx injected PATH; fixed in github/gh-aw-firewall#6407)
+- `TCP_DENIED` in Squid access log for a topology peer or `difcProxyHost` during agent run; in-session MCP/HTTP calls to those hosts fail in network-isolation mode → B13 (topology peer hostnames and `difcProxyHost` not added to `NO_PROXY`; fixed in github/gh-aw-firewall#6189 and github/gh-aw-firewall#6438)


 | D7 | Claude Code (Bun runtime) crashes with `SIGSEGV` / `SIGABRT` under `--container-runtime gvisor`; the harness retries multiple times, each attempt failing with exit code 1; no output or minimal output is produced | gVisor restricts the W^X (write XOR execute) memory operations required by JIT compilers. Bun uses JavaScriptCore (JSC) with JIT enabled by default; JSC generates native code via JIT, triggering SIGSEGV/SIGABRT on gVisor's restricted syscall surface | **AWF (PR github/gh-aw-firewall#6276) automatically sets `BUN_JSC_useJIT=0`** at runtime via `buildToolEnvironment()` when Claude runs under gVisor — no workflow change required. For older AWF builds without github/gh-aw-firewall#6276, pass `--env BUN_JSC_useJIT=0` (or set it as a job-level env var with `--env-all`) as a manual fallback. | Inside the AWF gVisor agent container: `echo $BUN_JSC_useJIT` should be `0`; a crash without this flag confirms the mode via `SIGSEGV`/`SIGABRT` signal in agent logs | github/gh-aw-firewall#6260, github/gh-aw-firewall#6261, github/gh-aw-firewall#6276 |
 | D8 | MCP tool calls (`safeoutputs`, `github`) return `403 ERR_ACCESS_DENIED` under `--container-runtime gvisor` or raw `runsc`; agent completes but never writes safe outputs; smoke tests fail at "Validate safe outputs were invoked"; direct `/dev/tcp` connections fail with `No route to host` | gVisor's userspace netstack is isolated from the host network namespace. The iptables DNAT `RETURN` bypass rule (installed by `awf-iptables-init`) that normally lets the agent reach the MCP gateway (`172.30.0.1:8080`) directly never fires under gVisor. MCP requests follow `HTTP_PROXY` into Squid and receive `403 ERR_ACCESS_DENIED` because the MCP gateway IP is not in the domain allowlist. | **Fixed in AWF (PR github/gh-aw-firewall#6401)**: `runtimeUsesIptables()` returns `false` for `gvisor` and its raw `runsc` alias (plus `sbx`); `awf-iptables-init` is skipped for these runtimes (`AWF_SKIP_IPTABLES_INIT=1`); the MCP gateway (`172.30.0.1`) and `host.docker.internal` are added to `NO_PROXY` so proxy-aware MCP clients connect directly. **Caveat:** proxy-unaware tools using raw sockets (e.g. `/dev/tcp`) still get `No route to host` under gVisor — egress requires proxy-aware clients. | Inspect Squid access log for `403` on `172.30.0.1`; check `NO_PROXY` env inside the agent container — should include `172.30.0.1` when runtime is `gvisor` or raw `runsc` on patched AWF | github/gh-aw-firewall#6401, github/gh-aw-firewall#6326 |
 | D9 | On `--container-runtime sbx`, credential files (`~/.aws/credentials`, `~/.ssh/id_rsa`, `~/.docker/config.json`, `~/.kube/config`, `~/.azure/`, `~/.gnupg/`, `~/.netrc`, `~/.config/gh/hosts.yml`, `~/.config/gcloud/`, `~/.cargo/credentials.toml`, `~/.claude/.credentials.json`, `~/.copilot/config.json`, `~/.gemini/oauth_creds.json`) are visible to the agent inside the sbx microVM | AWF before PR github/gh-aw-firewall#6336 mounted the entire host `$HOME` (read-write) into the sbx microVM. Unlike compose mode (empty home volume + `/dev/null` overlays), sbx uses virtiofs passthrough where mounts are directory-granular and file-level overlays are not expressible. | **Fixed in AWF (PR github/gh-aw-firewall#6336)**: `sbx-manager.ts` mounts only whitelisted tool/cache + agent-state subdirs (`HOME_TOOL_SUBDIRS` + `.copilot`/`.gemini`). For whitelisted dirs that contain nested credential files (e.g. `~/.config/gh/hosts.yml`, `~/.cargo/credentials.toml`, `~/.copilot/config.json`), `scrubHomeCredentials()` moves them aside to `.awf-sbx-cred-backup-<pid>` before `sbx create` and `restoreHomeCredentials()` restores them after teardown. Workaround (older AWF): do not use `--container-runtime sbx` with real credentials in `$HOME`. | `ls $HOME/.aws $HOME/.ssh $HOME/.docker 2>/dev/null` inside the sbx sandbox — if dirs are visible, fix is not applied; confirm AWF version includes github/gh-aw-firewall#6336 | github/gh-aw-firewall#6336 |
+| D10 | On `--container-runtime sbx`, Copilot CLI installed via `install_copilot_cli.sh --rootless` (redirects install to `~/.local/bin`) is **not found** even though `~/.local` is mounted into the microVM; `copilot: command not found` or `ENOENT` at agent startup | sbx microVMs do not run AWF's `entrypoint.sh` (which prepends `$HOME/.local/bin` to PATH). `buildCoreEnvironment()` injected only `/usr/local/sbin:...:/bin` as `PATH`. The binary is present in the VM but unreachable by name. Docker/gVisor compose runtimes were unaffected because `entrypoint.sh` fixed PATH for them. | **Fixed in AWF (PR github/gh-aw-firewall#6407, merged 2026-07-19):** `buildCoreEnvironment()` now prepends `${HOME}/.local/bin` to the injected PATH, fixing sbx without affecting compose runtimes. Upgrade to the AWF version including github/gh-aw-firewall#6407. Workaround (older AWF): use the non-rootless install (requires sudo on the runner) or pass `--env PATH=/home/runner/.local/bin:$PATH` explicitly. | Inside the sbx agent: `echo $PATH` — `~/.local/bin` should appear first; `which copilot` or `ls ~/.local/bin/copilot` confirms binary presence vs PATH visibility | github/gh-aw-firewall#6407 |



 D9 / github/gh-aw-firewall#6336 — sbx microVMs previously mounted the entire host `$HOME`, exposing credentials such as `~/.aws/credentials`, `~/.ssh/id_rsa`, and `~/.docker/config.json`. **Fixed in AWF (PR github/gh-aw-firewall#6336)**: sbx now mounts only whitelisted home subdirectories, and `scrubHomeCredentials()` / `restoreHomeCredentials()` temporarily move nested credential files out of the mounted tree during sandbox lifetime.

+D10 / github/gh-aw-firewall#6407 — On `--container-runtime sbx`, the Copilot CLI installed rootless to `~/.local/bin` was not found because `buildCoreEnvironment()` did not include `~/.local/bin` in the injected PATH and sbx microVMs do not run AWF's `entrypoint.sh` to fix PATH. **Fixed in AWF (PR github/gh-aw-firewall#6407, merged 2026-07-19):** `buildCoreEnvironment()` now prepends `${HOME}/.local/bin` to PATH for all runtimes. Workaround (older AWF): use the non-rootless install or pass `--env PATH=/home/runner/.local/bin:$PATH`.



 D9 / github/gh-aw-firewall#6336 — sbx microVMs previously mounted the entire host `$HOME`, exposing credentials such as `~/.aws/credentials`, `~/.ssh/id_rsa`, and `~/.docker/config.json`. **Fixed in AWF (PR github/gh-aw-firewall#6336)**: sbx now mounts only whitelisted home subdirectories, and `scrubHomeCredentials()` / `restoreHomeCredentials()` temporarily move nested credential files out of the mounted tree during sandbox lifetime.

+D10 / github/gh-aw-firewall#6407 — On `--container-runtime sbx`, the Copilot CLI installed rootless to `~/.local/bin` was not found because `buildCoreEnvironment()` did not include `~/.local/bin` in the injected PATH and sbx microVMs do not run AWF's `entrypoint.sh` to fix PATH. **Fixed in AWF (PR github/gh-aw-firewall#6407, merged 2026-07-19):** `buildCoreEnvironment()` now prepends `${HOME}/.local/bin` to PATH for all runtimes. Workaround (older AWF): use the non-rootless install or pass `--env PATH=/home/runner/.local/bin:$PATH`.


 | D7 | Claude Code (Bun runtime) crashes with `SIGSEGV` / `SIGABRT` under `--container-runtime gvisor`; the harness retries multiple times, each attempt failing with exit code 1; no output or minimal output is produced | gVisor restricts the W^X (write XOR execute) memory operations required by JIT compilers. Bun uses JavaScriptCore (JSC) with JIT enabled by default; JSC generates native code via JIT, triggering SIGSEGV/SIGABRT on gVisor's restricted syscall surface | **AWF (PR github/gh-aw-firewall#6276) automatically sets `BUN_JSC_useJIT=0`** at runtime via `buildToolEnvironment()` when Claude runs under gVisor — no workflow change required. For older AWF builds without github/gh-aw-firewall#6276, pass `--env BUN_JSC_useJIT=0` (or set it as a job-level env var with `--env-all`) as a manual fallback. | Inside the AWF gVisor agent container: `echo $BUN_JSC_useJIT` should be `0`; a crash without this flag confirms the mode via `SIGSEGV`/`SIGABRT` signal in agent logs | github/gh-aw-firewall#6260, github/gh-aw-firewall#6261, github/gh-aw-firewall#6276 |
 | D8 | MCP tool calls (`safeoutputs`, `github`) return `403 ERR_ACCESS_DENIED` under `--container-runtime gvisor` or raw `runsc`; agent completes but never writes safe outputs; smoke tests fail at "Validate safe outputs were invoked"; direct `/dev/tcp` connections fail with `No route to host` | gVisor's userspace netstack is isolated from the host network namespace. The iptables DNAT `RETURN` bypass rule (installed by `awf-iptables-init`) that normally lets the agent reach the MCP gateway (`172.30.0.1:8080`) directly never fires under gVisor. MCP requests follow `HTTP_PROXY` into Squid and receive `403 ERR_ACCESS_DENIED` because the MCP gateway IP is not in the domain allowlist. | **Fixed in AWF (PR github/gh-aw-firewall#6401)**: `runtimeUsesIptables()` returns `false` for `gvisor` and its raw `runsc` alias (plus `sbx`); `awf-iptables-init` is skipped for these runtimes (`AWF_SKIP_IPTABLES_INIT=1`); the MCP gateway (`172.30.0.1`) and `host.docker.internal` are added to `NO_PROXY` so proxy-aware MCP clients connect directly. **Caveat:** proxy-unaware tools using raw sockets (e.g. `/dev/tcp`) still get `No route to host` under gVisor — egress requires proxy-aware clients. | Inspect Squid access log for `403` on `172.30.0.1`; check `NO_PROXY` env inside the agent container — should include `172.30.0.1` when runtime is `gvisor` or raw `runsc` on patched AWF | github/gh-aw-firewall#6401, github/gh-aw-firewall#6326 |
 | D9 | On `--container-runtime sbx`, credential files (`~/.aws/credentials`, `~/.ssh/id_rsa`, `~/.docker/config.json`, `~/.kube/config`, `~/.azure/`, `~/.gnupg/`, `~/.netrc`, `~/.config/gh/hosts.yml`, `~/.config/gcloud/`, `~/.cargo/credentials.toml`, `~/.claude/.credentials.json`, `~/.copilot/config.json`, `~/.gemini/oauth_creds.json`) are visible to the agent inside the sbx microVM | AWF before PR github/gh-aw-firewall#6336 mounted the entire host `$HOME` (read-write) into the sbx microVM. Unlike compose mode (empty home volume + `/dev/null` overlays), sbx uses virtiofs passthrough where mounts are directory-granular and file-level overlays are not expressible. | **Fixed in AWF (PR github/gh-aw-firewall#6336)**: `sbx-manager.ts` mounts only whitelisted tool/cache + agent-state subdirs (`HOME_TOOL_SUBDIRS` + `.copilot`/`.gemini`). For whitelisted dirs that contain nested credential files (e.g. `~/.config/gh/hosts.yml`, `~/.cargo/credentials.toml`, `~/.copilot/config.json`), `scrubHomeCredentials()` moves them aside to `.awf-sbx-cred-backup-<pid>` before `sbx create` and `restoreHomeCredentials()` restores them after teardown. Workaround (older AWF): do not use `--container-runtime sbx` with real credentials in `$HOME`. | `ls $HOME/.aws $HOME/.ssh $HOME/.docker 2>/dev/null` inside the sbx sandbox — if dirs are visible, fix is not applied; confirm AWF version includes github/gh-aw-firewall#6336 | github/gh-aw-firewall#6336 |
+| D10 | On `--container-runtime sbx`, Copilot CLI installed via `install_copilot_cli.sh --rootless` (redirects install to `~/.local/bin`) is **not found** even though `~/.local` is mounted into the microVM; `copilot: command not found` or `ENOENT` at agent startup | sbx microVMs do not run AWF's `entrypoint.sh` (which prepends `$HOME/.local/bin` to PATH). `buildCoreEnvironment()` injected only `/usr/local/sbin:...:/bin` as `PATH`. The binary is present in the VM but unreachable by name. Docker/gVisor compose runtimes were unaffected because `entrypoint.sh` fixed PATH for them. | **Fixed in AWF (PR github/gh-aw-firewall#6407, merged 2026-07-19):** `buildCoreEnvironment()` now prepends `${HOME}/.local/bin` to the injected PATH, fixing sbx without affecting compose runtimes. Upgrade to the AWF version including github/gh-aw-firewall#6407. Workaround (older AWF): use the non-rootless install (requires sudo on the runner) or pass `--env PATH=/home/runner/.local/bin:$PATH` explicitly. | Inside the sbx agent: `echo $PATH` — `~/.local/bin` should appear first; `which copilot` or `ls ~/.local/bin/copilot` confirms binary presence vs PATH visibility | github/gh-aw-firewall#6407 |


 | B11 | AWF exits with code 1 and logs show `[WARN] Rootless artifact permission repair failed ... (exit 1)` plus cleanup warnings, but no actionable stderr detail from the repair container | `fixArtifactPermissionsForRootless()` previously discarded repair-container stderr, so the warning hid the real failure context. The non-zero exit code comes from `runAgentCommand()` before cleanup; cleanup warnings do not override it. | **Improved in AWF (PR github/gh-aw-firewall#6072, merged 2026-07-10)**: stderr from the repair container is now captured in the warning, and chroot-home cleanup noise is reduced by downgrading that log from `warn` to `debug`. Treat this mode as diagnostic-opacity around a pre-existing non-zero command exit, not cleanup-driven exit-code mutation. | Compare agent-command logs with `Command completed with exit code: <n>`; on affected versions, repair warnings lack stderr context. On AWF including github/gh-aw-firewall#6072, the warning includes stderr detail for root-cause triage. | github/gh-aw-firewall#6070, github/gh-aw-firewall#6072 |
 | B12 | `getaddrinfo EAI_AGAIN <awmg-cli-proxy>` or `ENOTFOUND <awmg-cli-proxy>` → `awf-cli-proxy could not connect to the external DIFC proxy` → `The agent was never invoked` on ARC/DinD, and DinD containers cannot resolve the Kubernetes Service name even after the ordering fix | ARC/DinD DNS isolation: the DinD Docker network does not forward DNS to the cluster resolver, so Kubernetes Service names such as `awmg-cli-proxy` are unreachable from AWF containers even though the service exists. | **Diagnosed in AWF (PR github/gh-aw-firewall#6328, merged 2026-07-17):** `detectDnsResolutionFailure()` scans cli-proxy logs for `EAI_AGAIN`/`ENOTFOUND`, extracts the unresolved hostname, and augments the startup error with concrete remediation. Address the DIFC proxy by IP, or configure `dockerd --dns <cluster-dns-ip>` so DinD containers can reach the cluster DNS server. | `docker run --rm alpine nslookup awmg-cli-proxy` — `NXDOMAIN`/`SERVFAIL` confirms the Kubernetes DNS is not reachable from DinD containers; compare with the augmented startup error from `detectDnsResolutionFailure()` | github/gh-aw-firewall#6326, github/gh-aw-firewall#6328 |
+| B13 | In `--network-isolation` mode, MCP tool calls to topology-attached peers (e.g. `awmg-mcpg`) or to a `difcProxyHost` configured independently of `topologyAttach` return connection errors or are logged as `TCP_DENIED` in Squid's access log; the agent can reach the DIFC proxy host during startup (B5/B12) but individual in-session MCP/HTTP calls to those same hosts fail or produce Squid 403 noise | `buildProxyEnvironment()` assembled `NO_PROXY` from a static list of AWF-internal hosts but did not include (a) `config.topologyAttach` peer hostnames or (b) `config.difcProxyHost`. Proxy-aware clients (Node `undici`, curl) honoured `HTTPS_PROXY` for those hosts; Squid denied them because they are not in the domain allowlist. | **Fixed in AWF (PR github/gh-aw-firewall#6189, merged 2026-07-20):** `config.topologyAttach` peer hostnames are now added to `NO_PROXY`/`no_proxy`. **Fixed in AWF (PR github/gh-aw-firewall#6438, merged 2026-07-20):** `config.difcProxyHost` (stripped of any `:port` suffix) is also added to `NO_PROXY`. Upgrade AWF to version including both PRs. | Inspect Squid `access.log` for `TCP_DENIED` entries whose target host is a topology peer or the DIFC proxy host; inside the agent container check `echo $NO_PROXY` — the topology peer and DIFC proxy hostname should appear | github/gh-aw-firewall#6189, github/gh-aw-firewall#6438 |
+| B14 | After upgrading to AWF including the centralized mount-policy refactor (PR github/gh-aw-firewall#6339), the Copilot CLI agent exits immediately (exit code 1, ~0.5 s, zero stdout/stderr); no network calls are made; the issue appears on Docker and gVisor runtimes but not sbx (which moves files aside rather than overlay-masking them) | PR github/gh-aw-firewall#6339 added `~/.copilot/config.json` to the credential **deny list** with reason *"Copilot CLI persisted auth token"*. This is incorrect: `config.json` contains only experiment flags, first-launch timestamps, and plugin metadata — no token. AWF masks denied files with a **read-only** `/dev/null` bind-mount overlay. The Copilot CLI reads **and atomically rewrites** `config.json` via temp-file + rename at startup; a rename cannot target a bind-mounted path and the overlay is read-only, so the CLI crashes silently. | **Fixed in AWF (PR github/gh-aw-firewall#6374, merged 2026-07-18):** `~/.copilot/config.json` is removed from the credential deny list; the file is bind-mounted read-write as part of the `.copilot` tool subdir (pre-#6339 behaviour). Upgrade to the AWF version including github/gh-aw-firewall#6374. Workaround (older AWF): pass `--keep-containers` and inspect the agent container for `EROFS` or rename errors; downgrade AWF past github/gh-aw-firewall#6339 if unpatched. | `awf ... copilot agent --version` — if it exits 1 with no output in ~0.5 s, confirm AWF version includes github/gh-aw-firewall#6374; inspect agent container logs for `EROFS`/`rename` errors on `~/.copilot/config.json` | github/gh-aw-firewall#6339, github/gh-aw-firewall#6374 |


 | B11 | AWF exits with code 1 and logs show `[WARN] Rootless artifact permission repair failed ... (exit 1)` plus cleanup warnings, but no actionable stderr detail from the repair container | `fixArtifactPermissionsForRootless()` previously discarded repair-container stderr, so the warning hid the real failure context. The non-zero exit code comes from `runAgentCommand()` before cleanup; cleanup warnings do not override it. | **Improved in AWF (PR github/gh-aw-firewall#6072, merged 2026-07-10)**: stderr from the repair container is now captured in the warning, and chroot-home cleanup noise is reduced by downgrading that log from `warn` to `debug`. Treat this mode as diagnostic-opacity around a pre-existing non-zero command exit, not cleanup-driven exit-code mutation. | Compare agent-command logs with `Command completed with exit code: <n>`; on affected versions, repair warnings lack stderr context. On AWF including github/gh-aw-firewall#6072, the warning includes stderr detail for root-cause triage. | github/gh-aw-firewall#6070, github/gh-aw-firewall#6072 |
 | B12 | `getaddrinfo EAI_AGAIN <awmg-cli-proxy>` or `ENOTFOUND <awmg-cli-proxy>` → `awf-cli-proxy could not connect to the external DIFC proxy` → `The agent was never invoked` on ARC/DinD, and DinD containers cannot resolve the Kubernetes Service name even after the ordering fix | ARC/DinD DNS isolation: the DinD Docker network does not forward DNS to the cluster resolver, so Kubernetes Service names such as `awmg-cli-proxy` are unreachable from AWF containers even though the service exists. | **Diagnosed in AWF (PR github/gh-aw-firewall#6328, merged 2026-07-17):** `detectDnsResolutionFailure()` scans cli-proxy logs for `EAI_AGAIN`/`ENOTFOUND`, extracts the unresolved hostname, and augments the startup error with concrete remediation. Address the DIFC proxy by IP, or configure `dockerd --dns <cluster-dns-ip>` so DinD containers can reach the cluster DNS server. | `docker run --rm alpine nslookup awmg-cli-proxy` — `NXDOMAIN`/`SERVFAIL` confirms the Kubernetes DNS is not reachable from DinD containers; compare with the augmented startup error from `detectDnsResolutionFailure()` | github/gh-aw-firewall#6326, github/gh-aw-firewall#6328 |
+| B13 | In `--network-isolation` mode, MCP tool calls to topology-attached peers (e.g. `awmg-mcpg`) or to a `difcProxyHost` configured independently of `topologyAttach` return connection errors or are logged as `TCP_DENIED` in Squid's access log; the agent can reach the DIFC proxy host during startup (B5/B12) but individual in-session MCP/HTTP calls to those same hosts fail or produce Squid 403 noise | `buildProxyEnvironment()` assembled `NO_PROXY` from a static list of AWF-internal hosts but did not include (a) `config.topologyAttach` peer hostnames or (b) `config.difcProxyHost`. Proxy-aware clients (Node `undici`, curl) honoured `HTTPS_PROXY` for those hosts; Squid denied them because they are not in the domain allowlist. | **Fixed in AWF (PR github/gh-aw-firewall#6189, merged 2026-07-20):** `config.topologyAttach` peer hostnames are now added to `NO_PROXY`/`no_proxy`. **Fixed in AWF (PR github/gh-aw-firewall#6438, merged 2026-07-20):** `config.difcProxyHost` (stripped of any `:port` suffix) is also added to `NO_PROXY`. Upgrade AWF to version including both PRs. | Inspect Squid `access.log` for `TCP_DENIED` entries whose target host is a topology peer or the DIFC proxy host; inside the agent container check `echo $NO_PROXY` — the topology peer and DIFC proxy hostname should appear | github/gh-aw-firewall#6189, github/gh-aw-firewall#6438 |
+| B14 | After upgrading to AWF including the centralized mount-policy refactor (PR github/gh-aw-firewall#6339), the Copilot CLI agent exits immediately (exit code 1, ~0.5 s, zero stdout/stderr); no network calls are made; the issue appears on Docker and gVisor runtimes but not sbx (which moves files aside rather than overlay-masking them) | PR github/gh-aw-firewall#6339 added `~/.copilot/config.json` to the credential **deny list** with reason *"Copilot CLI persisted auth token"*. This is incorrect: `config.json` contains only experiment flags, first-launch timestamps, and plugin metadata — no token. AWF masks denied files with a **read-only** `/dev/null` bind-mount overlay. The Copilot CLI reads **and atomically rewrites** `config.json` via temp-file + rename at startup; a rename cannot target a bind-mounted path and the overlay is read-only, so the CLI crashes silently. | **Fixed in AWF (PR github/gh-aw-firewall#6374, merged 2026-07-18):** `~/.copilot/config.json` is removed from the credential deny list; the file is bind-mounted read-write as part of the `.copilot` tool subdir (pre-#6339 behaviour). Upgrade to the AWF version including github/gh-aw-firewall#6374. Workaround (older AWF): pass `--keep-containers` and inspect the agent container for `EROFS` or rename errors; downgrade AWF past github/gh-aw-firewall#6339 if unpatched. | `awf ... copilot agent --version` — if it exits 1 with no output in ~0.5 s, confirm AWF version includes github/gh-aw-firewall#6374; inspect agent container logs for `EROFS`/`rename` errors on `~/.copilot/config.json` | github/gh-aw-firewall#6339, github/gh-aw-firewall#6374 |


 - `FATAL: http_port: IPv6 is not available` → B3
 - `No CA certificates were loaded from the system` in chroot on RHEL/Fedora/Amazon Linux → B9 (missing /etc/pki/ mount)
- `[WARN] Rootless artifact permission repair failed` with each attempt taking ~30 s (registry timeout, not instant) → B10 (compound tag@digest ref causes Docker to attempt GHCR manifest verification even under `--pull never`)
+- `[WARN] Rootless artifact permission repair failed` with each attempt taking ~30 s (registry timeout, not instant) → B10 (compound tag@digest ref causes Docker to attempt GHCR manifest verification even under `--pull never`; or, even with a tag-only ref, `docker run` missing `--entrypoint sh` causes AWF's own `entrypoint.sh` to run and wait ~30 s for iptables-init — fixed in github/gh-aw-firewall#6342/github/gh-aw-firewall#6356)


 - `FATAL: http_port: IPv6 is not available` → B3
 - `No CA certificates were loaded from the system` in chroot on RHEL/Fedora/Amazon Linux → B9 (missing /etc/pki/ mount)
- `[WARN] Rootless artifact permission repair failed` with each attempt taking ~30 s (registry timeout, not instant) → B10 (compound tag@digest ref causes Docker to attempt GHCR manifest verification even under `--pull never`)
+- `[WARN] Rootless artifact permission repair failed` with each attempt taking ~30 s (registry timeout, not instant) → B10 (compound tag@digest ref causes Docker to attempt GHCR manifest verification even under `--pull never`; or, even with a tag-only ref, `docker run` missing `--entrypoint sh` causes AWF's own `entrypoint.sh` to run and wait ~30 s for iptables-init — fixed in github/gh-aw-firewall#6342/github/gh-aw-firewall#6356)


lpcox · 2026-07-20T22:03:10Z

@copilot address review feedback

Copilot · 2026-07-20T22:09:35Z

@copilot address review feedback

Addressed in 901d379.

Updated the three mirrored Runner Doctor sources to fix D10 wording/workaround (sbx command wrapper after bash -lc init), removed ~/.copilot/config.json from D9 credential signals/examples, and made B10 timing text non-registry-specific. Regenerated .github/workflows/self-hosted-runner-doctor.lock.yml and updated the corresponding workflow test expectations.

lpcox · 2026-07-20T22:19:03Z

@copilot resolve the merge conflicts in this pull request

…-doctor-catalog # Conflicts: # .github/workflows/self-hosted-runner-doctor.lock.yml

github-actions · 2026-07-20T22:21:41Z

✅ Copilot review passed with no inline comments.

@copilot Add the ready-for-aw label to this PR to trigger agentic CI smoke tests.

github-actions · 2026-07-20T22:23:53Z

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	98.76%	98.79%	📈 +0.03%
Statements	98.70%	98.73%	📈 +0.03%
Functions	99.28%	99.28%	➡️ +0.00%
Branches	95.01%	95.01%	➡️ +0.00%

📁 Per-file Coverage Changes (1 files)

File	Lines (Before → After)	Statements (Before → After)
`src/log-directory-setup.ts`	96.2% → 100.0% (+3.78%)	96.3% → 100.0% (+3.71%)

Coverage comparison generated by scripts/ci/compare-coverage.ts

github-actions · 2026-07-20T22:29:53Z

🔌 Smoke Services — All services reachable! ✅

github-actions · 2026-07-20T22:29:53Z

✅ Smoke Claude passed

github-actions · 2026-07-20T22:29:55Z

✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓

github-actions · 2026-07-20T22:29:55Z

✅ Contribution Check completed successfully!

PR #6445 follows the applicable CONTRIBUTING.md guidelines: the change is documentation-only, includes a clear description and issue reference, and updates the mirrored docs consistently. No missing tests or file-organization issues to flag.

github-actions · 2026-07-20T22:29:55Z

✅ Smoke Gemini completed. All facets verified. 💎

Smoke tests complete. Overall status: FAIL. Connectivity to github.com failed. File writing and bash tool tests passed. PRs identified: #6446, #6438.

github-actions · 2026-07-20T22:30:08Z

Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded.

github-actions · 2026-07-20T22:30:09Z

✅ Smoke Copilot BYOK AOAI (api-key) completed. Copilot AOAI BYOK (api-key) mode operational. 🔓

github-actions · 2026-07-20T22:33:02Z

🔍 Smoke Test Results

Test	Status
GitHub MCP connectivity	✅ MCP reachable (secrecy policy filtered PR data — expected for private repo)
GitHub.com HTTP connectivity	⚠️ Pre-step template vars not expanded
File write/read	⚠️ Pre-step template vars not expanded

Overall: PARTIAL — MCP engine is operational; pre-step smoke data was not injected (template variables unexpanded, likely a workflow configuration issue).

@lpcox — smoke test ran but steps.smoke-data.outputs were not available to the agent.

📰 BREAKING: Report filed by Smoke Copilot
_{Add label ready-for-aw to run again}

github-actions · 2026-07-20T22:33:05Z

Smoke Test: Claude Engine Validation

Check	Result
API status	✅ PASS
gh check	✅ PASS
File status	✅ PASS

Overall result: PASS

Generated by Smoke Claude for #6445 · 54.4 AIC · ⊞ 3.3K · ◷
_{Add label ready-for-aw to run again}

github-actions · 2026-07-20T22:33:07Z

@lpcox — Smoke test: Copilot Network Isolation Egress Enforcement

EGRESS_RESULT allow=pass deny=pass

✅ Allowed domain (api.github.com) — HTTP 200
✅ Blocked domain (example.com) — 403 proxy denial

Overall: PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

example.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "example.com"

See Network Configuration for more information.

🛡️ Egress verdict from Smoke Copilot Network Isolation
_{Add label ready-for-aw to run again}

github-actions · 2026-07-20T22:33:20Z

Smoke Test Results — FAIL

Check	Result
Redis PING	❌ Name resolution failed for `host.docker.internal`
PostgreSQL pg_isready	❌ No response
PostgreSQL SELECT 1	❌ Name resolution failed

Overall: FAIL — host.docker.internal is not resolvable in this environment. Service containers may not be running or DNS is not configured to reach them.

🔌 Service connectivity validated by Smoke Services
_{Add label ready-for-aw to run again}

github-actions · 2026-07-20T22:33:32Z

@lpcox

MCP PR data: ✅
GitHub.com HTTP: ✅
File read/write: ✅
BYOK inference: ✅
Running in direct BYOK mode (AWF_AUTH_TYPE=github-oidc + AWF_AUTH_AZURE_* + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (Foundry, o4-mini-aw) authenticated via Microsoft Entra

Overall PASS

🪪 BYOK (AOAI Entra) report filed by Smoke Copilot BYOK AOAI (Entra)
_{Add label ready-for-aw to run again}

github-actions · 2026-07-20T22:33:46Z

🔥 AWF Smoke Test — PAT Auth

Test	Result
GitHub MCP connectivity	✅ Connected
github.com HTTP	✅ 200 OK
File write/read	❌ File not found (template vars unresolved)

Overall: FAIL

Auth mode: PAT (COPILOT_GITHUB_TOKEN)

Note: steps.smoke-data.outputs template variables were not substituted — pre-step likely did not run or outputs were not set.

🔑 PAT report filed by Smoke Copilot PAT
_{Add label ready-for-aw to run again}

github-actions · 2026-07-20T22:33:52Z

Smoke test results: FAIL

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

localhost

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "localhost"

See Network Configuration for more information.

💎 Faceted by Smoke Gemini
_{Add label ready-for-aw to run again}

github-actions · 2026-07-20T22:33:58Z

Smoke test results:

chore: upgrade gh-aw extension to v0.82.14 pre-release ✅
fix: exempt DIFC/cli-proxy host from proxy routing in isolation mode ✅
GitHub page title contains GitHub ✅
Smoke file write/read ✅
npm ci && npm run build ✅
Overall: PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

github-actions · 2026-07-20T22:34:03Z

Smoke Test: Copilot BYOK (Direct) Mode

✅ GitHub MCP connectivity verified
✅ BYOK inference path working (agent → api-proxy → api.githubcopilot.com)
✅ Agent environment configured with dummy COPILOT_API_KEY placeholder
⚠️ Pre-fetched test data (HTTP code, file tests) not provided in environment

Status: Infrastructure tests PASS
Mode: Direct BYOK (COPILOT_PROVIDER_API_KEY)

🔑 BYOK report filed by Smoke Copilot BYOK
_{Add label ready-for-aw to run again}

github-actions · 2026-07-20T22:34:09Z

Smoke Test: API Proxy OpenTelemetry Tracing

Scenario	Result	Notes
S1: Module Loading	✅	`otel.js` loads successfully; exports: `startRequestSpan`, `setTokenAttributes`, `setBudgetAttributes`, `endSpan`, `endSpanError`, `shutdown`, `isEnabled` + internal symbols
S2: Test Suite	✅	59 passed, 0 failed across `otel.test.js` + `otel-fanout.test.js` (GenAI attrs, OTLP exporter, file exporter, serialization, span lifecycle)
S3: Env Var Forwarding	✅	`src/services/api-proxy-env-config.ts` forwards `OTEL_EXPORTER_OTLP_ENDPOINT`, `OTEL_EXPORTER_OTLP_HEADERS`, `GITHUB_AW_OTEL_TRACE_ID`, `GITHUB_AW_OTEL_PARENT_SPAN_ID`, `OTEL_SERVICE_NAME` (defaults to `awf-api-proxy`)
S4: Token Tracker Integration	✅	`onUsage` callback exists in `token-tracker-http.js` (line 343); invoked after normalized usage extraction — confirmed OTEL hook point
S5: OTEL Diagnostics	✅	No runtime spans exported (no OTEL endpoint configured in sandbox); graceful degradation confirmed — no errors when unconfigured

Summary: All 5 scenarios pass. OTEL tracing integration is fully functional in containers/api-proxy/.

📡 OTel tracing validated by Smoke OTel Tracing
_{Add label ready-for-aw to run again}

github-actions · 2026-07-20T22:34:34Z

Chroot Runtime Version Check ✅

Runtime	Host Version	Chroot Version	Match?
Python	Python 3.12.13	Python 3.12.13	✅
Node.js	v24.18.0	v24.18.0	✅
Go	go1.22.12	go1.22.12	✅

All runtimes match between host and chroot environments.

Tested by Smoke Chroot
_{Add label ready-for-aw to run again}

github-actions · 2026-07-20T22:34:51Z

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A	✅ PASS
.NET	json-parse	✅	N/A	✅ PASS
Go	color	✅	1/1 passed	✅ PASS
Go	env	✅	1/1 passed	✅ PASS
Go	uuid	✅	1/1 passed	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	All passed	✅ PASS
Node.js	execa	✅	All passed	✅ PASS
Node.js	p-limit	✅	All passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — ✅ PASS

Generated by Build Test Suite for #6445 · 38.5 AIC · ⊞ 8.3K · ◷
_{Add label ready-for-aw to run again}

github-actions · 2026-07-20T22:35:02Z

@lpcox smoke test results:

GitHub MCP connectivity: ✅
GitHub.com connectivity: ✅
File I/O test: ✅
BYOK inference test: ✅

Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (Foundry, o4-mini-aw)

Overall: PASS

🔑 BYOK (AOAI api-key) report filed by Smoke Copilot BYOK AOAI (api-key)
_{Add label ready-for-aw to run again}

github-actions · 2026-07-20T22:36:57Z

🔥 Smoke Test: Docker Sbx Validation

Test	Result
GitHub MCP connectivity	✅ (data filtered by secrecy policy, but connected)
GitHub.com HTTP	✅ HTTP 200
File write/read	⚠️ Template vars not substituted — smoke file not found

Overall: PASS (core connectivity verified; file test inconclusive due to unresolved template variables)

PR author: @lpcox

📰 BREAKING: Report filed by Smoke Docker Sbx
_{Add label ready-for-aw to run again}

Initial plan

fa24d2b

Copilot AI assigned Copilot and lpcox Jul 20, 2026

Copilot started work on behalf of lpcox July 20, 2026 20:09 View session

Copilot AI linked an issue Jul 20, 2026 that may be closed by this pull request

🩺 Runner Doctor UpdateRunner Doctor catalog update — 2026-07-17 to 2026-07-20 scan (B10 repair entrypoint, Copilot config.json mask, sbx PATH, difcPro [Content truncated due to length] #6444

Closed

docs: update Runner Doctor catalog — B10 fix, B13/B14/D10 new entries…

6b636b1

… (2026-07-17–20 scan)

Copilot AI changed the title ~~[WIP] Update Runner Doctor catalog for 2026 scan window~~ docs: Runner Doctor catalog update — B10 entrypoint fix, B13/B14/D10 new entries (2026-07-17–20 scan) Jul 20, 2026

Copilot finished work on behalf of lpcox July 20, 2026 20:17

Copilot AI requested a review from lpcox July 20, 2026 20:17

lpcox marked this pull request as ready for review July 20, 2026 21:29

Copilot AI review requested due to automatic review settings July 20, 2026 21:29

Copilot started reviewing on behalf of lpcox July 20, 2026 21:29 View session

Copilot AI reviewed Jul 20, 2026

View reviewed changes

Copilot started work on behalf of lpcox July 20, 2026 22:03 View session

docs: address runner doctor review feedback and regenerate lock

901d379

Copilot finished work on behalf of lpcox July 20, 2026 22:10

lpcox closed this Jul 20, 2026

lpcox reopened this Jul 20, 2026

Merge remote-tracking branch 'origin/main' into copilot/update-runner…

097612a

…-doctor-catalog # Conflicts: # .github/workflows/self-hosted-runner-doctor.lock.yml

lpcox added the ready-for-aw label Jul 20, 2026

lpcox mentioned this pull request Jul 20, 2026

fix(docs-site): resolve high-severity js-yaml npm audit finding #6450

Merged

github-actions Bot added the smoke-claude label Jul 20, 2026

github-actions Bot added the smoke-copilot-network-isolation Copilot network-isolation egress smoke test label Jul 20, 2026

lpcox temporarily deployed to aoai-model July 20, 2026 22:33 — with GitHub Actions Inactive

github-actions Bot added the smoke-copilot-byok-aoai-entra label Jul 20, 2026

github-actions Bot mentioned this pull request Jul 20, 2026

[aw] No-Op Runs #5883

Open

lpcox temporarily deployed to aoai-model July 20, 2026 22:33 — with GitHub Actions Inactive

github-actions Bot added the smoke-codex label Jul 20, 2026

github-actions Bot added the smoke-copilot-byok label Jul 20, 2026

github-actions Bot added the smoke-chroot label Jul 20, 2026

github-actions Bot added the build-test label Jul 20, 2026

github-actions Bot added the smoke-copilot-byok-aoai-apikey label Jul 20, 2026

lpcox merged commit e962a77 into main Jul 20, 2026
137 of 141 checks passed

lpcox deleted the copilot/update-runner-doctor-catalog branch July 20, 2026 22:49


		D9 / github/gh-aw-firewall#6336 — sbx microVMs previously mounted the entire host `$HOME`, exposing credentials such as `~/.aws/credentials`, `~/.ssh/id_rsa`, and `~/.docker/config.json`. Fixed in AWF (PR github/gh-aw-firewall#6336): sbx now mounts only whitelisted home subdirectories, and `scrubHomeCredentials()` / `restoreHomeCredentials()` temporarily move nested credential files out of the mounted tree during sandbox lifetime.

		D10 / github/gh-aw-firewall#6407 — On `--container-runtime sbx`, the Copilot CLI installed rootless to `~/.local/bin` was not found because `buildCoreEnvironment()` did not include `~/.local/bin` in the injected PATH and sbx microVMs do not run AWF's `entrypoint.sh` to fix PATH. Fixed in AWF (PR github/gh-aw-firewall#6407, merged 2026-07-19): `buildCoreEnvironment()` now prepends `${HOME}/.local/bin` to PATH for all runtimes. Workaround (older AWF): use the non-rootless install or pass `--env PATH=/home/runner/.local/bin:$PATH`.

Uh oh!

Conversation

Copilot AI commented Jul 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Error-string lookup additions

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

lpcox commented Jul 20, 2026

Uh oh!

Copilot AI commented Jul 20, 2026

Uh oh!

lpcox commented Jul 20, 2026

Uh oh!

github-actions Bot commented Jul 20, 2026

Uh oh!

github-actions Bot commented Jul 20, 2026

✅ Coverage Check Passed

Overall Coverage

Uh oh!

github-actions Bot commented Jul 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 20, 2026

🔍 Smoke Test Results

Uh oh!

github-actions Bot commented Jul 20, 2026

Smoke Test: Claude Engine Validation

Uh oh!

github-actions Bot commented Jul 20, 2026

Uh oh!

github-actions Bot commented Jul 20, 2026

Smoke Test Results — FAIL

Uh oh!

github-actions Bot commented Jul 20, 2026

Uh oh!

github-actions Bot commented Jul 20, 2026

🔥 AWF Smoke Test — PAT Auth

Uh oh!

github-actions Bot commented Jul 20, 2026

Uh oh!

github-actions Bot commented Jul 20, 2026

Uh oh!

github-actions Bot commented Jul 20, 2026

Smoke Test: Copilot BYOK (Direct) Mode

Uh oh!

github-actions Bot commented Jul 20, 2026

Smoke Test: API Proxy OpenTelemetry Tracing

Uh oh!

github-actions Bot commented Jul 20, 2026

Chroot Runtime Version Check ✅

Uh oh!

github-actions Bot commented Jul 20, 2026

🏗️ Build Test Suite Results

Uh oh!

github-actions Bot commented Jul 20, 2026

Uh oh!

github-actions Bot commented Jul 20, 2026

Copilot AI commented Jul 20, 2026 •

edited

Loading

github-actions Bot commented Jul 20, 2026 •

edited

Loading

github-actions Bot commented Jul 20, 2026 •

edited

Loading

github-actions Bot commented Jul 20, 2026 •

edited

Loading

github-actions Bot commented Jul 20, 2026 •

edited

Loading

github-actions Bot commented Jul 20, 2026 •

edited

Loading

github-actions Bot commented Jul 20, 2026 •

edited

Loading

github-actions Bot commented Jul 20, 2026 •

edited

Loading