refactor: share backpressure stream writer by Copilot · Pull Request #8799 · github/gh-aw-firewall

Copilot · 2026-09-20T16:27:44Z

The vsock and NVX adapters duplicated stream backpressure and error-handling logic. This centralizes that behavior and consistently skips empty buffers.

Shared utility
- Adds writeWithBackpressure() to src/stream-utils.ts.
- Handles immediate writes, drain, errors, and listener cleanup.
Adapter integration
- Replaces both local implementations with the shared helper.
Behavior coverage
- Covers empty buffers, immediate writes, backpressure, and write errors.

Fixes [Duplicate Code] writeWithBackpressure helper is repeated across vsock and NVX adapters #8783

Copilot

Copilot review overview

🟡 Changes recommended

Accepted writes can still fail asynchronously after the helper removes its error listener.

Get a fresh assessment by requesting another Copilot review.

Review effort: Balanced
Findings: 1

Open (1)

Propagate asynchronous write errors when write returns true · New

What changed in this PR

Centralizes writable-stream backpressure handling shared by the NVX and vsock adapters.

Changes:

Adds writeWithBackpressure() with empty-buffer handling.
Replaces duplicated adapter helpers.
Adds focused unit coverage.

File	Description
`src/stream-utils.ts`	Adds the shared stream-writing helper.
`src/stream-utils.test.ts`	Tests empty, immediate, backpressured, and error cases.
`src/nvx/one-shot-adapter.ts`	Uses the shared helper.
`src/microvm/vsock-client.ts`	Uses the shared helper.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

+    if (destination.write(data)) {
+      cleanup();
+      resolve();


lpcox · 2026-09-20T17:25:51Z

@copilot address review feedback

Copilot · 2026-09-20T17:32:33Z

@copilot address review feedback

Addressed in cad469d: the writer now waits for the per-write callback, retains the error listener through asynchronous failures, and includes regression coverage.

github-actions · 2026-09-20T17:33:55Z

✅ Copilot review passed with no inline comments.

@copilot Add the ready-for-aw label to this PR to trigger agentic CI smoke tests.

github-actions · 2026-09-20T17:37:43Z

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	93.28%	93.31%	📈 +0.03%
Statements	91.95%	91.98%	📈 +0.03%
Functions	92.16%	92.23%	📈 +0.07%
Branches	85.78%	85.79%	📈 +0.01%

📁 Per-file Coverage Changes (3 files)

File	Lines (Before → After)	Statements (Before → After)
`src/microvm/vsock-client.ts`	97.3% → 97.1% (-0.19%)	93.5% → 93.1% (-0.39%)
`src/nvx/one-shot-adapter.ts`	79.8% → 80.1% (+0.30%)	77.3% → 77.4% (+0.10%)
`src/log-directory-setup.ts`	96.2% → 100.0% (+3.78%)	96.3% → 100.0% (+3.71%)

✨ New Files (1 files)

src/stream-utils.ts: 100.0% lines

Coverage comparison generated by scripts/ci/compare-coverage.ts

github-actions · 2026-09-20T18:19:21Z

🚀 Security Guard has started processing this pull request

github-actions · 2026-09-20T18:19:21Z

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

Warning

Firewall blocked 8 domains

The following domains were blocked by the firewall during workflow execution:

accounts.google.com
android.clients.google.com
clients2.google.com
contentautofill.googleapis.com
msfeed25.pkgs.visualstudio.com
update.googleapis.com
www.google.com
www.gstatic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "accounts.google.com"
    - "android.clients.google.com"
    - "clients2.google.com"
    - "contentautofill.googleapis.com"
    - "msfeed25.pkgs.visualstudio.com"
    - "update.googleapis.com"
    - "www.google.com"
    - "www.gstatic.com"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex

github-actions · 2026-09-20T18:19:22Z

Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded.

Tested by Smoke Chroot

github-actions · 2026-09-20T18:19:23Z

❌ Smoke Copilot BYOK AOAI (Entra) reports failed. AOAI BYOK (Entra) mode investigation needed...

🪪 BYOK (AOAI Entra) report filed by Smoke Copilot BYOK AOAI (Entra)

github-actions · 2026-09-20T18:19:23Z

✅ Smoke Claude passed

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

api.anthropic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.anthropic.com"

See Network Configuration for more information.

Generated by Smoke Claude for #8799

github-actions · 2026-09-20T18:19:23Z

✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓

🔑 BYOK report filed by Smoke Copilot BYOK

github-actions · 2026-09-20T18:19:25Z

🛡️ Smoke Copilot Network Isolation confirmed the egress allowlist is enforced. ✅

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

example.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "example.com"

See Network Configuration for more information.

🛡️ Egress verdict from Smoke Copilot Network Isolation

github-actions · 2026-09-20T18:19:25Z

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

📰 BREAKING: Report filed by Smoke Copilot

github-actions · 2026-09-20T18:19:26Z

📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅

📡 OTel tracing validated by Smoke OTel Tracing

github-actions · 2026-09-20T18:19:28Z

❌ Smoke Gemini reports failed. Facets need polishing...

💎 Faceted by Smoke Gemini

github-actions · 2026-09-20T18:19:30Z

✅ Build Test Suite completed successfully!

Generated by Build Test Suite for #8799

github-actions · 2026-09-20T18:19:43Z

❌ Smoke Copilot BYOK AOAI (api-key) reports failed. AOAI BYOK (api-key) mode investigation needed...

🔑 BYOK (AOAI api-key) report filed by Smoke Copilot BYOK AOAI (api-key)

github-actions · 2026-09-20T18:20:02Z

🔌 Smoke Services — All services reachable! ✅

🔌 Service connectivity validated by Smoke Services

github-actions · 2026-09-20T18:22:12Z

Smoke Test: Claude Engine Validation

Check	Status
API	✅ PASS
GitHub CLI	✅ PASS
File	✅ PASS

Overall result: PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

api.anthropic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.anthropic.com"

See Network Configuration for more information.

Generated by Smoke Claude for #8799 · claude · haiku45 · 56.5 AIC · ⊞ 4.7K · ◷
_{Add label ready-for-aw to run again}

github-actions · 2026-09-20T18:22:56Z

Smoke Test: Copilot Engine — @lpcox

✅ GitHub MCP: PR Deduplicate nested-KVM connectivity probe test setup #8800 "Deduplicate nested-KVM connectivity probe test setup"
✅ GitHub.com connectivity (HTTP 200)
✅ File write/read test

Overall: PASS

📰 BREAKING: Report filed by Smoke Copilot
_{Add label ready-for-aw to run again}

github-actions · 2026-09-20T18:23:00Z

EGRESS_RESULT allow=pass deny=pass

✅ Allowed domain (github.com) reachable: allowed=200
✅ Non-allowed domain (example.com) blocked: CONNECT tunnel failed (403)

Overall: PASS

cc @lpcox

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

example.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "example.com"

See Network Configuration for more information.

🛡️ Egress verdict from Smoke Copilot Network Isolation
_{Add label ready-for-aw to run again}

github-actions · 2026-09-20T18:23:02Z

Smoke Test: Copilot BYOK (Direct) — PASS ✅

✅ GitHub MCP connectivity: PR list matches pre-fetched data
✅ GitHub.com connectivity: HTTP 200
✅ File write/read: Test file verified
✅ BYOK inference: Running in direct mode (COPILOT_PROVIDER_API_KEY → api-proxy → api.githubcopilot.com)

Running as @lpcox. All systems operational.

🔑 BYOK report filed by Smoke Copilot BYOK
_{Add label ready-for-aw to run again}

github-actions · 2026-09-20T18:23:44Z

Smoke Test Results:

Redis PING: ✅ (PONG)
PostgreSQL pg_isready: ✅ (accepting connections)
PostgreSQL SELECT 1: ✅ (1)

Overall: PASS

🔌 Service connectivity validated by Smoke Services
_{Add label ready-for-aw to run again}

github-actions · 2026-09-20T18:23:59Z

Chroot Version Comparison

Runtime	Host Version	Chroot Version	Match?
Python	Python 3.12.14	Python 3.12.14	✅ YES
Node.js	v24.21.0	v22.23.2	❌ NO
Go	go1.22.12	go1.22.12	✅ YES

Result: Not all versions match — Node.js differs between host and chroot environments. smoke-chroot label not applied.

Tested by Smoke Chroot
_{Add label ready-for-aw to run again}

github-actions · 2026-09-20T18:24:12Z

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A (run OK)	✅ PASS
.NET	json-parse	✅	N/A (run OK)	✅ PASS
Go	color	✅	ok	✅ PASS
Go	env	✅	ok	✅ PASS
Go	uuid	✅	ok	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	all passed	✅ PASS
Node.js	execa	✅	all passed	✅ PASS
Node.js	p-limit	✅	all passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — PASS

Note: Java Maven builds initially failed with Could not create local repository at /home/runner/.m2/repository — the pre-existing ~/.m2 directory was root-owned (not created by this workflow) and not writable by the runner user. Worked around by pointing Maven at a writable local repo (-Dmaven.repo.local=/tmp/gh-aw/agent/m2repo); all other steps completed as specified. No network/firewall issues encountered across any ecosystem.

Generated by Build Test Suite for #8799 · copilot · auto · 42.9 AIC · ⊞ 11.8K · ◷
_{Add label ready-for-aw to run again}

github-actions · 2026-09-20T18:24:15Z

Smoke test: PASS

Merged PRs:

Deduplicate nested-KVM connectivity probe test setup #8800 Deduplicate nested-KVM connectivity probe test setup
feat: add NVX Phase 3a confinement foundations #8785 feat: add NVX Phase 3a confinement foundations

Checks:

GitHub PR read ✅
Playwright title ✅
File write/read ✅
Discussion lookup/comment ✅
Build (npm ci && npm run build) ✅

Warning

Firewall blocked 8 domains

The following domains were blocked by the firewall during workflow execution:

accounts.google.com
android.clients.google.com
clients2.google.com
contentautofill.googleapis.com
msfeed25.pkgs.visualstudio.com
update.googleapis.com
www.google.com
www.gstatic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "accounts.google.com"
    - "android.clients.google.com"
    - "clients2.google.com"
    - "contentautofill.googleapis.com"
    - "msfeed25.pkgs.visualstudio.com"
    - "update.googleapis.com"
    - "www.google.com"
    - "www.gstatic.com"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

github-actions · 2026-09-20T18:25:11Z

📡 OTEL Tracing Smoke Test Results

#	Scenario	Result
1	Module Loading	✅ `otel.js` loaded; `isEnabled()` → `true`; exports 15 functions (`startRequestSpan`, `setTokenAttributes`, `setBudgetAttributes`, `endSpan`, `endSpanError`, `shutdown`, `isEnabled`, etc.)
2	Test Suite	✅ 68/68 tests passed across 3 suites (`otel.test.js`, `otel-fanout.test.js`, `otel-workload-identity.test.js`) — 0 failures
3	Env Var Forwarding	✅ `env-passthrough.ts` forwards `GITHUB_AW_OTEL_TRACE_ID`/`GITHUB_AW_OTEL_PARENT_SPAN_ID`; `api-proxy-env-config.ts` forwards `GH_AW_OTLP_ENDPOINTS`, `OTEL_EXPORTER_OTLP_ENDPOINT`, and trace context vars
4	Token Tracker Integration	✅ `onUsage` callback present in `token-tracker-http.js` (OTEL hook point)
5	OTEL Diagnostics	✅ 7 token-usage records logged during run; no local `otel.jsonl` file — expected, since this workflow's `observability.otlp` config routes spans to the real Sentry OTLP endpoint rather than the file-based fallback exporter

Overall: All 5 scenarios passed. No regressions detected in OTEL tracing integration.

📡 OTel tracing validated by Smoke OTel Tracing
_{Add label ready-for-aw to run again}

Initial plan

b68f2b7

Copilot AI assigned Copilot and lpcox Sep 20, 2026

Copilot started work on behalf of lpcox September 20, 2026 16:27

View session

Copilot AI linked an issue Sep 20, 2026 that may be closed by this pull request

[Duplicate Code] writeWithBackpressure helper is repeated across vsock and NVX adapters #8783

Closed

refactor: share backpressure stream writer

3baee10

Copilot AI changed the title ~~[WIP] Refactor duplicate writeWithBackpressure helper in adapters~~ refactor: share backpressure stream writer Sep 20, 2026

Copilot finished work on behalf of lpcox September 20, 2026 16:33

Copilot AI requested a review from lpcox September 20, 2026 16:33

lpcox marked this pull request as ready for review September 20, 2026 16:36

Copilot AI balanced review requested due to automatic review settings September 20, 2026 16:36

Copilot started reviewing on behalf of lpcox September 20, 2026 16:36

View session

Copilot AI reviewed Sep 20, 2026

View reviewed changes

Comment thread src/stream-utils.ts Outdated

Comment on lines +23 to +25

if (destination.write(data)) {

cleanup();

resolve();

Copilot started work on behalf of lpcox September 20, 2026 17:26

View session

Copilot AI added 3 commits September 20, 2026 17:28

fix: await stream write completion

6e89b0c

fix: clean stream error listener

dc7a1f9

docs: clarify stream error cleanup

e91fe92

Copilot finished work on behalf of lpcox September 20, 2026 17:32

lpcox added the ready-for-aw label Sep 20, 2026

lpcox enabled auto-merge (squash) September 20, 2026 18:19

lpcox had a problem deploying to aoai-model September 20, 2026 18:19 — with GitHub Actions Failure

github-actions Bot added the smoke-claude label Sep 20, 2026

lpcox deployed to aoai-model September 20, 2026 18:22 — with GitHub Actions Active

github-actions Bot added the smoke-copilot label Sep 20, 2026

github-actions Bot added smoke-copilot-byok smoke-copilot-network-isolation Copilot network-isolation egress smoke test labels Sep 20, 2026

github-actions Bot added the smoke-services label Sep 20, 2026

github-actions Bot added the build-test label Sep 20, 2026

github-actions Bot added the smoke-codex label Sep 20, 2026

lpcox merged commit 0c4e8d2 into main Sep 20, 2026
178 of 183 checks passed

lpcox deleted the copilot/fix-duplicate-code-writewithbackpressure branch September 20, 2026 18:31

github-actions Bot mentioned this pull request Sep 21, 2026

🩺 Runner Doctor UpdateRunner Doctor knowledge-base update: D14 retry-fix follow-up (2026-09-19 scan) #8844

Closed

Copilot AI mentioned this pull request Sep 21, 2026

Sync D14 runner-doctor catalog with #8801 Cloud Hypervisor retry-fix follow-up #8854

Merged

Conversation

Copilot AI commented Sep 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

lpcox commented Sep 20, 2026

Uh oh!

Copilot AI commented Sep 20, 2026

Uh oh!

github-actions Bot commented Sep 20, 2026

Uh oh!

github-actions Bot commented Sep 20, 2026

✅ Coverage Check Passed

Overall Coverage

Uh oh!

github-actions Bot commented Sep 20, 2026

Uh oh!

github-actions Bot commented Sep 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 20, 2026

Smoke Test: Claude Engine Validation

Uh oh!

github-actions Bot commented Sep 20, 2026

Uh oh!

github-actions Bot commented Sep 20, 2026

Uh oh!

github-actions Bot commented Sep 20, 2026

Uh oh!

github-actions Bot commented Sep 20, 2026

Uh oh!

github-actions Bot commented Sep 20, 2026

Chroot Version Comparison

Uh oh!

github-actions Bot commented Sep 20, 2026

🏗️ Build Test Suite Results

Uh oh!

github-actions Bot commented Sep 20, 2026

Uh oh!

github-actions Bot commented Sep 20, 2026

📡 OTEL Tracing Smoke Test Results

Uh oh!

Uh oh!

Copilot AI commented Sep 20, 2026 •

edited

Loading

github-actions Bot commented Sep 20, 2026 •

edited

Loading

github-actions Bot commented Sep 20, 2026 •

edited

Loading

github-actions Bot commented Sep 20, 2026 •

edited

Loading

github-actions Bot commented Sep 20, 2026 •

edited

Loading

github-actions Bot commented Sep 20, 2026 •

edited

Loading

github-actions Bot commented Sep 20, 2026 •

edited

Loading

github-actions Bot commented Sep 20, 2026 •

edited

Loading

github-actions Bot commented Sep 20, 2026 •

edited

Loading

github-actions Bot commented Sep 20, 2026 •

edited

Loading

github-actions Bot commented Sep 20, 2026 •

edited

Loading

github-actions Bot commented Sep 20, 2026 •

edited

Loading

github-actions Bot commented Sep 20, 2026 •

edited

Loading