fix: allow --enable-host-access with --network-isolation (topology mode) by Copilot · Pull Request #6657 · github/gh-aw-firewall

Copilot · 2026-07-27T19:58:27Z

The gh-aw compiler emits network.isolation: true + topologyAttach alongside security.enableHostAccess: true (auto-triggered when localhost is in the domain allowlist). AWF was rejecting this combination — either a hard error in legacy mode or a silent suppression with a misleading "pass --legacy-security" warning in strict mode.

The mutual exclusion was wrong: in topology mode the agent runs on an internal Docker network with no host route, so no iptables-based host access is ever configured. --enable-host-access in that mode drives Squid port ACLs and the host.docker.internal hosts-file entry for topology peers — neither of which requires host-level iptables.

Changes

infrastructure-validator.ts — removes the hard error for networkIsolation + enableHostAccess; replaces it with a comment explaining the combination is intentionally valid.
security-mode.ts — adds && !config.networkIsolation to the strict-mode suppression block for enableHostAccess/allowHostPorts. Since strict mode forces networkIsolation = true before this check runs, host-access options are now preserved in all standard Docker-compose runs. allowHostServicePorts (iptables-based GitHub Actions services) is still suppressed unconditionally.
Tests — config-assembly-flags.test.ts repurposed from "should exit" to "should accept" for the combination; security-mode.test.ts updated to assert enableHostAccess is preserved in topology mode and allowHostServicePorts is still cleared.
docs/network-isolation-design.md — updated §8.1 to reflect that --enable-host-access is no longer rejected alongside --network-isolation.

Fixes [awf] cli: --network-isolation conflicts with auto-enabled --enable-host-access for localhost allowlist #6651

In network-isolation mode the agent runs on an internal Docker network with no direct host route, so host-level iptables are never configured. The --enable-host-access flag in that mode drives Squid port ACLs and the host.docker.internal hosts-file entry for topology peers (--topology-attach) rather than iptables rules, making the combination safe and valid. Before this change: - strict mode: silently disabled enableHostAccess with a misleading "pass --legacy-security" warning even though legacy-security + enableHostAccess + networkIsolation would hard-error in the validator - legacy mode: hard error "not supported with --enable-host-access" After this change: - enableHostAccess is preserved when networkIsolation=true (strict mode always forces networkIsolation=true, so the suppression block is only reached when networkIsolation=false, which never happens in strict mode) - The hard error in validateFeatureFlagCompatibility is removed; a comment explains why the combination is intentionally allowed - allowHostServicePorts (iptables-based GitHub Actions services) is still suppressed in strict mode regardless of topology mode Closes #6651

Copilot

Pull request overview

Allows host-access options to coexist with topology-based network isolation.

Changes:

Removes the incompatible-option rejection.
Preserves host-access settings in strict topology mode.
Updates tests and network-isolation documentation.

Show a summary per file

File	Description
`src/commands/validators/security-mode.ts`	Preserves topology-compatible host access.
`src/commands/validators/security-mode.test.ts`	Updates strict-mode expectations.
`src/commands/validators/infrastructure-validator.ts`	Removes mutual-exclusion validation.
`src/commands/validators/config-assembly-flags.test.ts`	Verifies the combination is accepted.
`docs/network-isolation-design.md`	Documents the new compatibility.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 5/5 changed files
Comments generated: 2
Review effort level: Medium

+  // NOTE: at this point in the pipeline, networkIsolation has already been
+  // forced to true above (for non-microVM runtimes), so
+  // !config.networkIsolation is false for standard Docker-compose runs.
+  if (config.enableHostAccess && !config.networkIsolation) {


+  // NOTE: at this point in the pipeline, networkIsolation has already been
+  // forced to true above (for non-microVM runtimes), so
+  // !config.networkIsolation is false for standard Docker-compose runs.
+  if (config.enableHostAccess && !config.networkIsolation) {


lpcox · 2026-07-27T23:10:30Z

@copilot address review feedback

Copilot · 2026-07-27T23:16:03Z

@copilot address review feedback

Addressed in 193466e.

I updated strict-mode handling so microVM runtimes still suppress enableHostAccess even if networkIsolation: true, and fixed topology-mode routing so host-gateway entries are no longer injected into NO_PROXY/hosts in compose topology mode. I also added compose-level and unit test assertions for this behavior.

github-actions · 2026-07-27T23:46:34Z

Documentation Preview

Documentation build failed for this PR. View logs.

Built from commit 8a9b83e

github-actions · 2026-07-27T23:47:34Z

✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓

github-actions · 2026-07-27T23:47:35Z

✅ Smoke Copilot BYOK AOAI (Entra) completed. Copilot AOAI BYOK (Entra) mode operational. 🔓

github-actions · 2026-07-27T23:47:35Z

✅ Smoke Gemini completed. All facets verified. 💎

github-actions · 2026-07-27T23:47:36Z

📰 VERDICT: Smoke Docker Sbx has concluded. All systems operational. This is a developing story. 🎤

github-actions · 2026-07-27T23:47:36Z

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

github-actions · 2026-07-27T23:47:37Z

🔌 Smoke Services — All services reachable! ✅

github-actions · 2026-07-27T23:47:39Z

✅ Contribution Check completed successfully!

Contribution check complete: PR #6657 follows the applicable CONTRIBUTING.md guidelines. It includes tests for the new behavior, updates documentation, has a clear description with a related issue reference, and keeps files in the expected src/ and docs/ locations.

github-actions · 2026-07-27T23:47:39Z

✅ Smoke Copilot BYOK AOAI (api-key) completed. Copilot AOAI BYOK (api-key) mode operational. 🔓

github-actions · 2026-07-27T23:47:40Z

✅ Smoke Claude passed

github-actions · 2026-07-27T23:50:52Z

Smoke Test: Claude Engine Validation

Check	Result
API status	✅ PASS
GH check	✅ PASS
File status	✅ PASS

Overall result: PASS ✅

Generated by Smoke Claude for #6657 · haiku45 · 30.9 AIC · ⊞ 3.3K · ◷
_{Add label ready-for-aw to run again}

github-actions · 2026-07-27T23:50:56Z

Smoke Test: Copilot BYOK (Direct) ✅

Test Results:

✅ MCP connectivity verified (PR data accessible)
✅ GitHub.com reachable (HTTP 200)
✅ File write/read working (smoke-test-copilot-byok.txt)
✅ BYOK inference path operational (agent → api-proxy → api.githubcopilot.com)

Mode: Direct BYOK (COPILOT_PROVIDER_API_KEY via api-proxy sidecar)

Status: PASS

🔑 BYOK report filed by Smoke Copilot BYOK
_{Add label ready-for-aw to run again}

github-actions · 2026-07-27T23:50:59Z

@lpcox — Smoke test: Copilot network isolation egress enforcement

EGRESS_RESULT allow=pass deny=pass

✅ Allowed domain (api.github.com) — HTTP 200
✅ Blocked domain (example.com) — 403 proxy denial

Overall: PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

example.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "example.com"

See Network Configuration for more information.

🛡️ Egress verdict from Smoke Copilot Network Isolation
_{Add label ready-for-aw to run again}

github-actions · 2026-07-27T23:51:07Z

Smoke Test Results — Services Connectivity

Check	Result
Redis PING	❌ Name resolution failed for `host.docker.internal`
PostgreSQL pg_isready	❌ No response
PostgreSQL SELECT 1	❌ Name resolution failed

Overall: FAIL — host.docker.internal is not resolvable in this environment. The AWF sandbox cannot reach the GitHub Actions service containers.

🔌 Service connectivity validated by Smoke Services
_{Add label ready-for-aw to run again}

github-actions · 2026-07-27T23:52:07Z

📡 OTel Tracing Smoke Test Results

Scenario	Status	Notes
S1: Module Loading	✅	`otel.js` loads; exports: `startRequestSpan`, `setTokenAttributes`, `setBudgetAttributes`, `endSpan`, `endSpanError`, `shutdown`, `isEnabled` + internals. `isEnabled: true`.
S2: Test Suite	✅	59 passed, 0 failed across 2 test suites (`otel.test.js`, `otel-fanout.test.js`) in 2.1s
S3: Env Var Forwarding	⚠️	`OTEL_EXPORTER_OTLP_ENDPOINT` / `GITHUB_AW_OTEL_TRACE_ID` not yet forwarded in `src/services/api-proxy-service.ts` — expected during development
S4: Token Tracker Integration	✅	`token-tracker-http.js` has `onUsage` callback (4 occurrences)
S5: OTEL Diagnostics	i️	No span file at runtime (api-proxy not live during smoke test) — expected

Overall: ✅ All implemented scenarios pass. S3 env-var forwarding is a known pending item (development phase).

📡 OTel tracing validated by Smoke OTel Tracing
_{Add label ready-for-aw to run again}

github-actions · 2026-07-27T23:52:22Z

Smoke Test: Gemini Engine Validation

GitHub MCP Testing: ❌ (Blocked by integrity policy)
GitHub.com Connectivity: ❌ (Transparent proxy failed)
File Writing Testing: ✅
Bash Tool Testing: ✅

Overall status: FAIL

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

localhost

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "localhost"

See Network Configuration for more information.

💎 Faceted by Smoke Gemini
_{Add label ready-for-aw to run again}

github-actions · 2026-07-27T23:53:27Z

Chroot Version Comparison Results

Runtime	Host Version	Chroot Version	Match?
Python	`Python 3.12.13`	`Python 3.12.13`	✅ YES
Node.js	`v24.18.0`	`v22.23.1`	❌ NO
Go	`go1.22.12`	`go1.22.12`	✅ YES

Overall: ❌ FAILED — Node.js version mismatch (host: v24.18.0, chroot: v22.23.1).

Tested by Smoke Chroot
_{Add label ready-for-aw to run again}

github-actions · 2026-07-27T23:54:28Z

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A	✅ PASS
.NET	json-parse	✅	N/A	✅ PASS
Go	color	✅	1/1 passed	✅ PASS
Go	env	✅	1/1 passed	✅ PASS
Go	uuid	✅	1/1 passed	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	All passed	✅ PASS
Node.js	execa	✅	All passed	✅ PASS
Node.js	p-limit	✅	All passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — ✅ PASS

Generated by Build Test Suite for #6657 · sonnet46 · 22.2 AIC · ⊞ 8.3K · ◷
_{Add label ready-for-aw to run again}

github-actions · 2026-07-27T23:54:48Z

🧪 Smoke Test: Docker Sbx — PASS

Test	Result
GitHub MCP connectivity	✅
GitHub.com HTTP	✅ 200
File write/read	✅

Overall: PASS

@lpcox

📰 BREAKING: Report filed by Smoke Docker Sbx
_{Add label ready-for-aw to run again}

github-actions · 2026-07-27T23:55:11Z

✅ Playwright GitHub title check
✅ Temp file write/read check
✅ npm ci && npm run build
⚠️ Merged PR review and discussion query were unavailable in this runner
Overall: FAIL

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

github-actions · 2026-07-27T23:55:50Z

@lpcox smoke test results:

GitHub MCP Connectivity: ✅
GitHub.com Connectivity: ✅
File Write/Read Test: ✅
BYOK Inference Test: ✅

Running in direct BYOK mode (AWF_AUTH_TYPE=github-oidc + AWF_AUTH_AZURE_* + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (Foundry, o4-mini-aw) authenticated via Microsoft Entra

Overall PASS

🪪 BYOK (AOAI Entra) report filed by Smoke Copilot BYOK AOAI (Entra)
_{Add label ready-for-aw to run again}

github-actions · 2026-07-27T23:56:10Z

@lpcox

GitHub MCP connectivity: ["fix: allow --enable-host-access with --network-isolation (topology mode)", "docs: Runner Doctor 2026-07-27 scan — B13 update + B15/B16 new failure modes"] ✅
GitHub.com connectivity ✅
File I/O ✅
Direct BYOK mode ✅
Overall: PASS
Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (Foundry, o4-mini-aw)

🔑 BYOK (AOAI api-key) report filed by Smoke Copilot BYOK AOAI (api-key)
_{Add label ready-for-aw to run again}

Initial plan

b1ec4c1

Copilot AI assigned Copilot and lpcox Jul 27, 2026

Copilot started work on behalf of lpcox July 27, 2026 19:59 View session

Copilot AI linked an issue Jul 27, 2026 that may be closed by this pull request

[awf] cli: --network-isolation conflicts with auto-enabled --enable-host-access for localhost allowlist #6651

Closed

Copilot AI changed the title ~~[WIP] Fix network isolation conflict with host access~~ fix: allow --enable-host-access with --network-isolation (topology mode) Jul 27, 2026

Copilot finished work on behalf of lpcox July 27, 2026 20:12

Copilot AI requested a review from lpcox July 27, 2026 20:12

lpcox marked this pull request as ready for review July 27, 2026 22:49

Copilot AI review requested due to automatic review settings July 27, 2026 22:49

Copilot started reviewing on behalf of lpcox July 27, 2026 22:50 View session

Copilot AI reviewed Jul 27, 2026

View reviewed changes

Copilot started work on behalf of lpcox July 27, 2026 23:11 View session

fix: topology host-access routing in strict mode

193466e

Copilot finished work on behalf of lpcox July 27, 2026 23:16

lpcox added the ready-for-aw label Jul 27, 2026

lpcox temporarily deployed to aoai-model July 27, 2026 23:47 — with GitHub Actions Inactive

github-actions Bot added smoke-claude smoke-copilot-byok labels Jul 27, 2026

github-actions Bot added the smoke-copilot-network-isolation Copilot network-isolation egress smoke test label Jul 27, 2026

github-actions Bot mentioned this pull request Jul 27, 2026

[aw] No-Op Runs #6621

Closed

github-actions Bot added the build-test label Jul 27, 2026

github-actions Bot added the smoke-docker-sbx label Jul 27, 2026

lpcox temporarily deployed to aoai-model July 27, 2026 23:55 — with GitHub Actions Inactive

github-actions Bot mentioned this pull request Jul 27, 2026

[aw] Smoke Codex reported incomplete result #6664

Closed

github-actions Bot added the smoke-copilot-byok-aoai-entra label Jul 27, 2026

lpcox temporarily deployed to aoai-model July 27, 2026 23:55 — with GitHub Actions Inactive

github-actions Bot added the smoke-copilot-byok-aoai-apikey label Jul 27, 2026

lpcox merged commit 0238b48 into main Jul 28, 2026
140 of 141 checks passed

lpcox deleted the copilot/awf-fix-network-isolation-conflict branch July 28, 2026 00:00

github-actions Bot mentioned this pull request Jul 28, 2026

🩺 Runner Doctor UpdateRunner Doctor 2026-07-28 scan — B15/B16 fixed, B13 log-aggregator update, A18 new XDG_CONFIG_HOME mode #6699

Closed

jeremyhayes mentioned this pull request Jul 28, 2026

[awf] network: isolation/topology mode + Tailscale → Squid 503 TCP_TUNNEL:HIER_NONE on api.githubcopilot.com egress #6704

Closed

This was referenced Jul 29, 2026

fix(dns): filter non-portable DNS in network-isolation + Tailscale #6705

Merged

docs: Runner Doctor 2026-07-28 scan — B15/B16 fixed, B13 log-aggregator update, A18 new XDG_CONFIG_HOME mode #6706

Merged

github-actions Bot mentioned this pull request Jul 31, 2026

[aw] No-Op Runs #6709

Open

Uh oh!

Conversation

Copilot AI commented Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

lpcox commented Jul 27, 2026

Uh oh!

Copilot AI commented Jul 27, 2026

Uh oh!

github-actions Bot commented Jul 27, 2026

Documentation Preview

Uh oh!

github-actions Bot commented Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 27, 2026

Smoke Test: Claude Engine Validation

Uh oh!

github-actions Bot commented Jul 27, 2026

Smoke Test: Copilot BYOK (Direct) ✅

Uh oh!

github-actions Bot commented Jul 27, 2026

Uh oh!

github-actions Bot commented Jul 27, 2026

Smoke Test Results — Services Connectivity

Uh oh!

github-actions Bot commented Jul 27, 2026

📡 OTel Tracing Smoke Test Results

Uh oh!

github-actions Bot commented Jul 27, 2026

Smoke Test: Gemini Engine Validation

Uh oh!

github-actions Bot commented Jul 27, 2026

Chroot Version Comparison Results

Uh oh!

github-actions Bot commented Jul 27, 2026

🏗️ Build Test Suite Results

Uh oh!

github-actions Bot commented Jul 27, 2026

🧪 Smoke Test: Docker Sbx — PASS

Uh oh!

github-actions Bot commented Jul 27, 2026

Uh oh!

github-actions Bot commented Jul 27, 2026

Uh oh!

github-actions Bot commented Jul 27, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Copilot AI commented Jul 27, 2026 •

edited

Loading

github-actions Bot commented Jul 27, 2026 •

edited

Loading

github-actions Bot commented Jul 27, 2026 •

edited

Loading

github-actions Bot commented Jul 27, 2026 •

edited

Loading

github-actions Bot commented Jul 27, 2026 •

edited

Loading

github-actions Bot commented Jul 27, 2026 •

edited

Loading

github-actions Bot commented Jul 27, 2026 •

edited

Loading

github-actions Bot commented Jul 27, 2026 •

edited

Loading

github-actions Bot commented Jul 27, 2026 •

edited

Loading

github-actions Bot commented Jul 27, 2026 •

edited

Loading