Recover Copilot endpoint incompatibilities without losing subagent tools by Copilot · Pull Request #9559 · github/gh-aw-firewall

Copilot · 2026-10-07T17:25:44Z

Copilot subagent requests could fail after successful egress because the selected model rejected the wire API or translation could not preserve custom tools.

Endpoint recovery
- Retry endpoint-rejection errors once on the other wire API using the same model.
- Attempt recovery before configured model fallback, including when endpoint metadata is missing or stale.
- Reframe retry bodies, force identity encoding, and map responses back to the client’s API.
Feature preservation
- Keep native custom-tool requests unchanged when the endpoint is supported.
- Return actionable HTTP 400 errors when translation cannot preserve features; never drop tools or invent a replacement model.
- Handle nullable response formats and contain unexpected recovery errors.
Coverage and documentation
- Add regressions for endpoint rejection, custom-tool compatibility, bounded retries, and explicit fallback.
- Document recovery behavior and custom-tool limits.

Fixes Make Copilot wire-API routing compatible with subagent tool requests #9558

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot

🟡 Changes recommended

Pre-translated requests cannot recover when stale metadata selects the wrong endpoint.

1 open finding

Stale metadata blocks recovery to the original API endpoint · New

What changed in this PR

Adds Copilot wire-API recovery while preserving request features and explicit fallback behavior.

Changes:

Retries endpoint incompatibilities using the alternate API.
Rejects lossy custom-tool translations with actionable errors.
Adds regression coverage and documentation.

File	Description
`docs/api-proxy-sidecar.md`	Documents recovery and custom-tool limits.
`containers/api-proxy/wire-api-compat.js`	Extends safe translation handling.
`containers/api-proxy/wire-api-compat.test.js`	Tests custom-tool compatibility.
`containers/api-proxy/upstream-retry.js`	Prioritizes endpoint recovery.
`containers/api-proxy/upstream-retry.test.js`	Tests retry ordering and errors.
`containers/api-proxy/upstream-response.js`	Connects recovery to response handling.
`containers/api-proxy/upstream-http.js`	Dispatches alternate-endpoint retries.
`containers/api-proxy/server.model-not-supported.test.js`	Tests end-to-end recovery behavior.
`containers/api-proxy/server.model-fallback-chain.test.js`	Updates fallback-chain expectations.

🧠 Review effort: Balanced

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

+          if (provider !== 'copilot' || !wireApiSourceBody ||
+              (wireApiCompatibility && !wireApiCompatibility.passthrough)) return false;


lpcox · 2026-10-07T19:21:30Z

@copilot address review feedback

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot · 2026-10-07T19:28:04Z

@copilot address review feedback

Fixed in c69d834: recovery now uses the rejected upstream endpoint, retries the original client endpoint with the preserved body and passthrough metadata when appropriate, and is bounded to one attempt.

github-actions · 2026-10-07T20:00:49Z

Documentation Preview

Documentation has been built for this PR.

Download preview artifact

To view locally:

Download the docs-preview-pr-9559 artifact from the workflow run
Unzip and open index.html in your browser

Built from commit f6e8832

github-actions · 2026-10-07T20:05:16Z

⚠️ Coverage Regression Detected

This PR decreases test coverage. Please add tests to maintain coverage levels.

Overall Coverage

Metric	Base	PR	Delta
Lines	93.00%	93.00%	➡️ +0.00%
Statements	91.49%	91.49%	➡️ +0.00%
Functions	90.20%	90.20%	➡️ +0.00%
Branches	85.26%	85.25%	📉 -0.01%

📁 Per-file Coverage Changes (2 files)

File	Lines (Before → After)	Statements (Before → After)
`src/nvx/one-shot-adapter.ts`	83.5% → 82.9% (-0.60%)	80.3% → 79.8% (-0.56%)
`src/log-directory-setup.ts`	96.8% → 100.0% (+3.18%)	96.9% → 100.0% (+3.13%)

Coverage comparison generated by scripts/ci/compare-coverage.ts

github-actions · 2026-10-07T20:37:27Z

🪪 Smoke Copilot BYOK AOAI (Entra) is testing Azure OpenAI BYOK (Entra / GitHub OIDC) mode on this pull request...

github-actions · 2026-10-07T20:37:28Z

🔑 Smoke Copilot BYOK is testing direct BYOK mode on this pull request...

github-actions · 2026-10-07T20:37:29Z

🔑 Smoke Copilot BYOK AOAI (api-key) is testing Azure OpenAI BYOK (api-key) mode on this pull request...

github-actions · 2026-10-07T20:37:29Z

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

📰 BREAKING: Report filed by Smoke Copilot

github-actions · 2026-10-07T20:37:29Z

✅ Build Test Suite completed successfully!

Generated by Build Test Suite for #9559

github-actions · 2026-10-07T20:37:30Z

💎 Smoke Gemini is crystallizing results on this pull request...

github-actions · 2026-10-07T20:37:31Z

✅ Smoke Claude passed

Generated by Smoke Claude for #9559

github-actions · 2026-10-07T21:23:45Z

🔮 The ancient spirits stir... Smoke Codex awakens to divine this pull request...

github-actions · 2026-10-07T21:23:45Z

Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded.

Tested by Smoke Chroot

github-actions · 2026-10-07T21:23:45Z

🪪 Smoke Copilot BYOK AOAI (Entra) is testing Azure OpenAI BYOK (Entra / GitHub OIDC) mode on this pull request...

github-actions · 2026-10-07T21:23:47Z

✅ Build Test Suite completed successfully!

Generated by Build Test Suite for #9559

github-actions · 2026-10-07T21:23:48Z

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

📰 BREAKING: Report filed by Smoke Copilot

github-actions · 2026-10-07T21:23:53Z

✅ Smoke Claude passed

Generated by Smoke Claude for #9559

github-actions · 2026-10-07T21:23:56Z

🔑 Smoke Copilot BYOK AOAI (api-key) is testing Azure OpenAI BYOK (api-key) mode on this pull request...

github-actions · 2026-10-07T21:33:52Z

Smoke Test: Cloud Hypervisor + Copilot

PASS: Listed merged PRs (latest closed PR Document host-run Compose access from firewalled Playwright #9560)
PASS: https://github.com returned 200
PASS: Wrote and read back /tmp/gh-aw/agent/smoke-cloud-hypervisor-37688958250.txt
PASS: (example.com/redacted) blocked with 000 (connection failed, not in allowlist)

All checks passed.

Cloud Hypervisor + Copilot smoke test by Smoke Cloud Hypervisor
_{Add label ready-for-aw to run again}

github-actions · 2026-10-07T21:34:44Z

Services smoke test: PASS

✅ Redis PING → PONG
✅ pg_isready → accepting connections
✅ PostgreSQL SELECT 1 → 1

🔌 Service connectivity validated by Smoke Services
_{Add label ready-for-aw to run again}

github-actions · 2026-10-07T21:34:45Z

Smoke Copilot: PASS ✅

✅ GitHub MCP (latest PR: "fix: validate pinned NVX release on hosted KVM")
✅ github.com connectivity (HTTP 200)
✅ File write/read

PR: "Recover Copilot endpoint incompatibilities without losing subagent tools"
Author: @Copilot · Assignees: @lpcox @Copilot

📰 BREAKING: Report filed by Smoke Copilot
_{Add label ready-for-aw to run again}

github-actions · 2026-10-07T21:35:19Z

Smoke Claude Results

API status: ✅ PASS
GH check: ✅ PASS
File status: ✅ PASS

Overall result: PASS

Generated by Smoke Claude for #9559 · claude · haiku45 · 45.4 AIC · ⊞ 6.1K · ◷
_{Add label ready-for-aw to run again}

github-actions · 2026-10-07T21:36:35Z

Chroot Version Comparison

Runtime	Host Version	Chroot Version	Match?
Python	Python 3.12.14	Python 3.12.14	✅ YES
Node.js	v24.21.0	v22.23.2	❌ NO
Go	go1.22.12	go1.22.12	✅ YES

Result: Not all tests passed (Node.js version mismatch), so the smoke-chroot label was not added.

Tested by Smoke Chroot
_{Add label ready-for-aw to run again}

github-actions · 2026-10-07T21:38:03Z

EGRESS_RESULT allow=pass deny=pass

✅ Allowed domain (api.github.com): HTTP 200
✅ Blocked domain (example.com): blocked (curl failed with a TLS cert error)

Overall: PASS — cc @lpcox

🛡️ Egress verdict from Smoke Copilot Network Isolation
_{Add label ready-for-aw to run again}

github-actions · 2026-10-07T21:38:20Z

Smoke Test: Copilot BYOK (Direct Mode) ✅

Test	Result
GitHub MCP connectivity	✅
github.com (HTTP 200)	✅
File write/read	✅
BYOK inference (agent → api-proxy → api.githubcopilot.com)	✅

Mode: Direct BYOK (COPILOT_PROVIDER_API_KEY) via api-proxy sidecar

Overall Status: ✅ PASS

🔑 BYOK report filed by Smoke Copilot BYOK
_{Add label ready-for-aw to run again}

github-actions · 2026-10-07T21:39:42Z

Smoke OTEL tracing

✅ S1 Module loads; exports startRequestSpan, setTokenAttributes, setBudgetAttributes, endSpan, endSpanError, shutdown, isEnabled, etc.
✅ S2 Tests: 3 suites, 68/68 passed
✅ S3 Env forwarding: trace/parent span IDs in env-passthrough.ts; OTLP vars in api-proxy-env-config.ts
✅ S4 onUsage hook present in token-tracker-http.js
✅ S5 Diagnostics: /tmp/gh-aw/otel.jsonl present (1 line); spans were not independently verified

📡 OTel tracing validated by Smoke OTel Tracing
_{Add label ready-for-aw to run again}

github-actions · 2026-10-07T21:41:26Z

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	❌	N/A	❌ FAIL (Bun install blocked by sandbox permission)
Bun	hono	❌	N/A	❌ FAIL (same)
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	❌	N/A	❌ FAIL (Deno install blocked by sandbox permission)
Deno	std	❌	N/A	❌ FAIL (same)
.NET	hello-world	✅	N/A	✅ PASS
.NET	json-parse	✅	N/A	✅ PASS
Go	color	✅	pass	✅ PASS
Go	env	✅	pass	✅ PASS
Go	uuid	✅	pass	✅ PASS
Java	gson	❌	N/A	❌ FAIL (`Could not create local repository at /home/runner/.m2/repository`)
Java	caffeine	❌	N/A	❌ FAIL (same)
Node.js	clsx	✅	all passed	✅ PASS
Node.js	execa	✅	all passed	✅ PASS
Node.js	p-limit	✅	all passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 5/8 ecosystems passed — FAIL

Failures: Bun and Deno could not run because the curl | bash installers were denied by the sandbox. Java failed because Maven could not create its local repository (~/.m2/repository) in this environment. No firewall-related errors were observed. All 8 clones succeeded.

Generated by Build Test Suite for #9559 · copilot · auto · 22.1 AIC · ⊞ 11.9K · ◷
_{Add label ready-for-aw to run again}

Initial plan

f748c93

Copilot AI assigned Copilot and lpcox Oct 7, 2026

Copilot started work on behalf of lpcox October 7, 2026 17:26

View session

Copilot AI linked an issue Oct 7, 2026 that may be closed by this pull request

Make Copilot wire-API routing compatible with subagent tool requests #9558

Closed

Copilot AI and others added 2 commits October 7, 2026 17:37

fix: recover Copilot wire API endpoint incompatibilities

8311059

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

fix: contain Copilot endpoint recovery translation errors

7e0e3e4

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Fix Copilot wire-API routing for subagent tool requests~~ Recover Copilot endpoint incompatibilities without losing subagent tools Oct 7, 2026

Copilot finished work on behalf of lpcox October 7, 2026 17:44

Copilot AI requested a review from lpcox October 7, 2026 17:44

lpcox marked this pull request as ready for review October 7, 2026 17:57

Copilot AI balanced review requested due to automatic review settings October 7, 2026 17:57

Copilot started reviewing on behalf of lpcox October 7, 2026 17:58

View session

Copilot AI reviewed Oct 7, 2026

View reviewed changes

Comment thread containers/api-proxy/upstream-http.js Outdated

Comment on lines +265 to +266

if (provider !== 'copilot' || !wireApiSourceBody ||

(wireApiCompatibility && !wireApiCompatibility.passthrough)) return false;

Copilot started work on behalf of lpcox October 7, 2026 19:22

View session

fix: recover pre-translated Copilot endpoint rejections

c69d834

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot finished work on behalf of lpcox October 7, 2026 19:28

lpcox added the ready-for-aw label Oct 7, 2026

lpcox enabled auto-merge (squash) October 7, 2026 20:00

lpcox had a problem deploying to aoai-model October 7, 2026 21:23 — with GitHub Actions Failure

lpcox enabled auto-merge (squash) October 7, 2026 21:27

github-actions Bot added the smoke-copilot-byok label Oct 7, 2026

lpcox temporarily deployed to aoai-model October 7, 2026 21:40 — with GitHub Actions Inactive

lpcox had a problem deploying to aoai-model October 7, 2026 21:40 — with GitHub Actions Failure

This was referenced Oct 7, 2026

[aw] Smoke Copilot BYOK AOAI (Entra) timed out #9653

Closed

[aw] Security Guard timed out #9654

Closed

lpcox disabled auto-merge October 7, 2026 21:42

lpcox merged commit 20c6a6f into main Oct 7, 2026
122 of 135 checks passed

lpcox deleted the copilot/make-copilot-wire-api-routing-compatible branch October 7, 2026 22:19

lpcox mentioned this pull request Oct 7, 2026

fix: hand off private Cloud Hypervisor diagnostics to runner ownership #9659

Merged

SivaKesava1 mentioned this pull request Oct 8, 2026

audit: sub-agent rows hide failures, ignore model aliases and dated ids, and have no per-agent spend (follow-up to #66740) github/gh-aw#66960

Closed

Copilot AI mentioned this pull request Oct 8, 2026

Report sub-agent failures, resolved models, and per-agent spend github/gh-aw#66961

Merged

SivaKesava1 mentioned this pull request Oct 9, 2026

Make Copilot wire-API routing compatible with subagent tool requests #9558

Closed

		if (provider !== 'copilot' \|\| !wireApiSourceBody \|\|
		(wireApiCompatibility && !wireApiCompatibility.passthrough)) return false;

Conversation

Copilot AI commented Oct 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

lpcox commented Oct 7, 2026

Uh oh!

Copilot AI commented Oct 7, 2026

Uh oh!

github-actions Bot commented Oct 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Documentation Preview

Uh oh!

github-actions Bot commented Oct 7, 2026

⚠️ Coverage Regression Detected

Overall Coverage

Uh oh!

github-actions Bot commented Oct 7, 2026

Uh oh!

github-actions Bot commented Oct 7, 2026

Uh oh!

github-actions Bot commented Oct 7, 2026

Uh oh!

github-actions Bot commented Oct 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 7, 2026

Uh oh!

github-actions Bot commented Oct 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 7, 2026

Uh oh!

github-actions Bot commented Oct 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 7, 2026

Uh oh!

github-actions Bot commented Oct 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 7, 2026

Uh oh!

github-actions Bot commented Oct 7, 2026

Smoke Test: Cloud Hypervisor + Copilot

Uh oh!

github-actions Bot commented Oct 7, 2026

Uh oh!

github-actions Bot commented Oct 7, 2026

Uh oh!

github-actions Bot commented Oct 7, 2026

Smoke Claude Results

Uh oh!

github-actions Bot commented Oct 7, 2026

Chroot Version Comparison

Uh oh!

github-actions Bot commented Oct 7, 2026

Uh oh!

github-actions Bot commented Oct 7, 2026

Smoke Test: Copilot BYOK (Direct Mode) ✅

Uh oh!

github-actions Bot commented Oct 7, 2026

Uh oh!

github-actions Bot commented Oct 7, 2026

🏗️ Build Test Suite Results

Uh oh!

Uh oh!

This branch had an error being deployed

Copilot AI commented Oct 7, 2026 •

edited

Loading

github-actions Bot commented Oct 7, 2026 •

edited

Loading

github-actions Bot commented Oct 7, 2026 •

edited

Loading

github-actions Bot commented Oct 7, 2026 •

edited

Loading

github-actions Bot commented Oct 7, 2026 •

edited

Loading

github-actions Bot commented Oct 7, 2026 •

edited

Loading

github-actions Bot commented Oct 7, 2026 •

edited

Loading

github-actions Bot commented Oct 7, 2026 •

edited

Loading

github-actions Bot commented Oct 7, 2026 •

edited

Loading