feat: add cli-proxy feature flag for AWF gh CLI proxy sidecar (firewall v0.25.14) (#24997)

* Initial plan

* feat: bump default AWF firewall version to v0.25.14

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/2e432b55-8a31-4eb8-ab16-7602b03acea2

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

* feat: add cli-proxy and cli-proxy-writable feature flags with AWF command injection

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/2e432b55-8a31-4eb8-ab16-7602b03acea2

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

* feat: add awfSupportsCliProxy version gate to prevent failures on older AWF versions

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/180bd43e-792e-4d72-b6b0-137eacfdd829

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

* fix: update wasm golden files for v0.25.14 and new actions permission (#25003)

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/45d7425a-e55e-4a76-8049-e58cad7ee0d6

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

* fix: resolve TypeScript errors in js workflow check (#25004)

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/d97ec115-fca7-468f-8455-80e276a712cf

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

* ci: remove stale js-qmd-index job whose test file was deleted (#25005)

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/7417d3b0-97d5-4b8f-baf1-dff3635cd5d2

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

* fix: update assign_to_agent tests to use handler factory pattern (#25008)

* fix: restore backward compat in assign_to_agent.cjs for standalone tests

The main() function was refactored to a handler factory pattern but tests
still use the old standalone interface (env vars + direct item processing).
Add standalone mode detection when main() is called with no config:
- Reads config from env vars (GH_AW_AGENT_DEFAULT, GH_AW_AGENT_MAX_COUNT, etc.)
- Processes all assign_to_agent items from GH_AW_AGENT_OUTPUT
- Writes summary, sets outputs, calls setFailed on errors
Also fix the "Ignore-if-error mode enabled" log message to match tests.

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/e00f51ce-33dd-493d-ba64-e13e1ebeb1be

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

* fix: address code review feedback on standalone mode detection

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/e00f51ce-33dd-493d-ba64-e13e1ebeb1be

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

* Update; rm -rf /

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

* fix: update assign_to_agent tests to use handler factory pattern

Replace `await main()` standalone calls in test evals with a STANDALONE_RUNNER
snippet that simulates the safe-output handler manager flow:
- build config from env vars
- call main(config) to get the handler function
- process assign_to_agent items through the handler
- write summary, set outputs, call setFailed on errors

Also fix the "encounters auth errors" assertion to match the production log message.

No changes to assign_to_agent.cjs production code.

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/d92459b5-9e9b-40ad-a0c6-108c70f23622

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Author: 3 people