Fix container smoke detection fallback (#106)

* Fix container smoke detection fallback

* Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Author: davidslater

.github/workflows/smoke-claude-container.lock.yml

@@ -67,9 +67,7 @@ type codexEngine struct {
 }
 
 func (e *codexEngine) Analyze(ctx context.Context, prompt string) (string, error) {
-	return runCLIWithPromptFile(ctx, "codex", prompt, func(promptPath string) []string {
-		return codexArgs(e.model, promptPath)
-	}, nil)
+	return runCLIEnv(ctx, "codex", codexArgs(e.model, ""), prompt, nil)
 }
 
 func copilotArgs(promptPath string) []string {
@@ -101,14 +99,15 @@ func claudeArgs(model string) []string {
 	return append(args, "-")
 }
 
-func codexArgs(model, promptPath string) []string {
+func codexArgs(model, prompt string) []string {
 	args := []string{
 		"exec",
 		"-c", "web_search=disabled",
 		"-c", "fetch=disabled",
 		"--dangerously-bypass-approvals-and-sandbox",
 		"--skip-git-repo-check",
-		"--prompt-file", promptPath,
+		"--",
+		prompt,
 	}
 	if model != "" {
 		args = append([]string{"-c", "model=" + model}, args...)

.github/workflows/smoke-codex-container.lock.yml

@@ -95,30 +95,32 @@ func TestEngineCommandArgs(t *testing.T) {
 	})
 
 	t.Run("codex", func(t *testing.T) {
-		got := codexArgs("gpt-5-codex", "/tmp/prompt.txt")
+		got := codexArgs("gpt-5-codex", "detect threats")
 		want := []string{
 			"-c", "model=gpt-5-codex",
 			"exec",
 			"-c", "web_search=disabled",
 			"-c", "fetch=disabled",
 			"--dangerously-bypass-approvals-and-sandbox",
 			"--skip-git-repo-check",
-			"--prompt-file", "/tmp/prompt.txt",
+			"--",
+			"detect threats",
 		}
 		if !reflect.DeepEqual(got, want) {
 			t.Fatalf("codexArgs() = %#v, want %#v", got, want)
 		}
 	})
 
 	t.Run("codex default model", func(t *testing.T) {
-		got := codexArgs("", "/tmp/prompt.txt")
+		got := codexArgs("", "detect threats")
 		want := []string{
 			"exec",
 			"-c", "web_search=disabled",
 			"-c", "fetch=disabled",
 			"--dangerously-bypass-approvals-and-sandbox",
 			"--skip-git-repo-check",
-			"--prompt-file", "/tmp/prompt.txt",
+			"--",
+			"detect threats",
 		}
 		if !reflect.DeepEqual(got, want) {
 			t.Fatalf("codexArgs() = %#v, want %#v", got, want)

.github/workflows/smoke-copilot-container.lock.yml

@@ -119,7 +119,7 @@ def replacement_steps(engine: str, workflow_description: str, awf_config_line: s
   env:
 {indent(engine_env(engine), 4)}
     THREAT_DETECTION_MODEL: ${{{{ vars.GH_AW_MODEL_DETECTION_{engine.upper()} || '' }}}}
-    THREAT_DETECTION_REFLECT_URL: http://127.0.0.1:8080/reflect
+    THREAT_DETECTION_REFLECT_URL: http://host.docker.internal:8080/reflect
     WORKFLOW_DESCRIPTION: {workflow_description}
     WORKFLOW_NAME: ${{{{ github.workflow }}}}
   run: |