You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
threat detection engine error
The threat detection engine encountered an error and could not complete analysis. This is a tooling failure, not a security finding.
Details
The threat detection engine failed to produce results.
Ran full inventory scan across Copilot (reflect + SDK), Anthropic, Gemini, and OpenAI. No
meaningful alias or pricing updates are needed this cycle: all current-generation models are
already matched by existing glob patterns in pkg/workflow/data/model_aliases.json, and every
Copilot-facing model checked in pkg/cli/data/models.json / actions/setup/js/models.json
matches the live Copilot SDK billing and reflect pricing data (per-token vs per-million-token
scaling accounted for).
Anthropic: id, display_name, created_at — used for family grouping (haiku/sonnet/opus); no pricing field in the raw API.
OpenAI: id, owned_by, created — naming conventions (-mini, -nano, o1/o3/o4) used to cross-check tiers; no pricing field in raw API.
Gemini: inputTokenLimit, outputTokenLimit, supportedGenerationMethods — used as a complexity/tier proxy; no explicit pricing field.
Copilot reflect: model_metadata[].pricing.default and .long_context (input/output/cachedInput/cacheWrite/threshold, in $/M-tokens) — primary live pricing cross-check.
Copilot SDK: billing.tokenPrices (inputPrice/outputPrice/cachePrice/cacheReadPrice/cacheWritePrice/contextMax + longContext sub-object, values in $/M-tokens) — cross-checked 1:1 against reflect and stored models.json cost fields (unit conversion: SDK/reflect values ÷ 100,000 == stored per-token cost).
Copilot docs pricing table (Playwright-rendered): only lists GPT-5.x family rows (Model/Release status/Category/Tier/Threshold/Input/Cached input/Output); matched exactly against SDK/reflect/stored values for gpt-5-mini, gpt-5.3-codex, gpt-5.4(-mini/-nano), gpt-5.5, gpt-5.6-luna/sol/terra.
models.json Pricing Analysis
Missing from models.json
No missing current-generation models. Live-only IDs beyond stored entries are either the
intentionally-deprecated set (gpt-4o-mini, gpt-4.1, gpt-4o, gpt-5.4-nano) or
internal/legacy variants not intended for the payload: auto, gpt-3.5-turbo*, gpt-4, gpt-4-0613, gpt-4-o-preview, gpt-4.1-2025-04-14, gpt-41-copilot, gpt-4o-2024-*, gpt-4o-mini-2024-07-18, embedding models (text-embedding-*), and trajectory-compaction.
Historical entries not currently returned
These remain in models.json as historical records (no removal proposed): claude-fable-5, claude-opus-4.5, claude-sonnet-4, gpt-5.2, gpt-5.2-codex, gpt-5.4-nano (intentionally deprecated, kept), kimi-k2.7-code, raptor-mini.
Inferred vs stored pricing discrepancies
None found. Spot-checked cost fields for claude-sonnet-5, claude-opus-5, claude-haiku-4.5, claude-opus-4.6/4.7/4.8, claude-sonnet-4.6, gpt-5.4, gpt-5.4-mini, gpt-5.5, gpt-5.3-codex, gpt-5-mini, gpt-5.6-sol/terra, mai-code-1-flash-picker, gemini-3.5-flash, gemini-3.1-pro-preview, and grok-4.5 against Copilot SDK billing.tokenPrices and reflect model_metadata[].pricing — all match the stored cost fields exactly (accounting for $/M-token → $/token scaling). provider_type and wire_api routing metadata for these entries are also consistent with source data.
pkg/cli/data/models.json and actions/setup/js/models.json remain byte-identical mirrors.
Proposed Alias Updates
None. All live current-generation model families (Claude Haiku/Sonnet/Opus 4.5–5, GPT-5.x
including Codex/mini/nano/pro variants, Gemini 2.x/3.x Flash/Pro, Grok 4.5, MAI-Code,
Kimi/Kiwi/Raptor) are already matched by existing glob patterns (sonnet, sonnet-6x, haiku, opus, gpt-5* family aliases, gemini-* family aliases, grok, mai-code*, kimi/kiwi/raptor-mini). Existing task-oriented aliases
(coding, reasoning, summarization, vision, small/mini, large, auto)
already cover the requested semantic categories. No stale patterns were found — every alias
pattern matches at least one live model, and unmatched live IDs are either deprecated or
internal/non-generation-relevant (audio, transcription, embeddings, moderation, or
experimental/codename builds not exposed for general use).
OpenAI (221): see /tmp/gh-aw/agent/model-inventory/artifacts/openai-models/models.json
(gpt-5.x family incl. codex/mini/nano/pro/chat-latest, o1/o3/o4 reasoning family incl.
deep-research variants, gpt-4.1/4o legacy family, audio/realtime/transcribe/tts models,
embeddings, moderation, sora-2, and numerous internal experimental/codename builds not
intended for general workflow use)
Notes
Playwright extraction of the GitHub Docs pricing table succeeded and only surfaces the
GPT-5.x tiered pricing rows (Anthropic/Gemini/Grok/MAI-Code pricing isn't published on that
page); all extracted values match SDK/reflect/stored data exactly.
gpt-4o-mini, gpt-4.1, gpt-4o, and gpt-5.4-nano continue to be treated as
intentionally deprecated and were excluded from gap analysis per policy.
Historical models.json entries no longer returned by live APIs (e.g. claude-opus-4.5, gpt-5.2, raptor-mini, kimi-k2.7-code) were left untouched, consistent with the
"no automatic removals" policy.
Warning
Firewall blocked 7 domains
The following domains were blocked by the firewall during workflow execution:
accounts.google.com
android.clients.google.com
clients2.google.com
collector.githubapp.com
contentautofill.googleapis.com
safebrowsingohttpgateway.googleapis.com
www.google.com
To allow these domains, add them to the network.allowed list in your workflow frontmatter:
Warning
threat detection engine error
The threat detection engine encountered an error and could not complete analysis. This is a tooling failure, not a security finding.
Details
The threat detection engine failed to produce results.
Review the workflow run logs for details.
Summary
Ran full inventory scan across Copilot (reflect + SDK), Anthropic, Gemini, and OpenAI. No
meaningful alias or pricing updates are needed this cycle: all current-generation models are
already matched by existing glob patterns in
pkg/workflow/data/model_aliases.json, and everyCopilot-facing model checked in
pkg/cli/data/models.json/actions/setup/js/models.jsonmatches the live Copilot SDK billing and reflect pricing data (per-token vs per-million-token
scaling accounted for).
Provider Model Counts
Raw API Fields Discovered
id,display_name,created_at— used for family grouping (haiku/sonnet/opus); no pricing field in the raw API.id,owned_by,created— naming conventions (-mini,-nano,o1/o3/o4) used to cross-check tiers; no pricing field in raw API.inputTokenLimit,outputTokenLimit,supportedGenerationMethods— used as a complexity/tier proxy; no explicit pricing field.model_metadata[].pricing.defaultand.long_context(input/output/cachedInput/cacheWrite/threshold, in $/M-tokens) — primary live pricing cross-check.billing.tokenPrices(inputPrice/outputPrice/cachePrice/cacheReadPrice/cacheWritePrice/contextMax +longContextsub-object, values in $/M-tokens) — cross-checked 1:1 against reflect and storedmodels.jsoncost fields (unit conversion: SDK/reflect values ÷ 100,000 == stored per-token cost).models.json Pricing Analysis
Missing from models.json
No missing current-generation models. Live-only IDs beyond stored entries are either the
intentionally-deprecated set (
gpt-4o-mini,gpt-4.1,gpt-4o,gpt-5.4-nano) orinternal/legacy variants not intended for the payload:
auto,gpt-3.5-turbo*,gpt-4,gpt-4-0613,gpt-4-o-preview,gpt-4.1-2025-04-14,gpt-41-copilot,gpt-4o-2024-*,gpt-4o-mini-2024-07-18, embedding models (text-embedding-*), andtrajectory-compaction.Historical entries not currently returned
These remain in
models.jsonas historical records (no removal proposed):claude-fable-5,claude-opus-4.5,claude-sonnet-4,gpt-5.2,gpt-5.2-codex,gpt-5.4-nano(intentionally deprecated, kept),kimi-k2.7-code,raptor-mini.Inferred vs stored pricing discrepancies
None found. Spot-checked cost fields for
$/M-token → $ /token scaling).
claude-sonnet-5,claude-opus-5,claude-haiku-4.5,claude-opus-4.6/4.7/4.8,claude-sonnet-4.6,gpt-5.4,gpt-5.4-mini,gpt-5.5,gpt-5.3-codex,gpt-5-mini,gpt-5.6-sol/terra,mai-code-1-flash-picker,gemini-3.5-flash,gemini-3.1-pro-preview, andgrok-4.5against Copilot SDKbilling.tokenPricesand reflectmodel_metadata[].pricing— all match the storedcostfields exactly (accounting forprovider_typeandwire_apirouting metadata for these entries are also consistent with source data.pkg/cli/data/models.jsonandactions/setup/js/models.jsonremain byte-identical mirrors.Proposed Alias Updates
None. All live current-generation model families (Claude Haiku/Sonnet/Opus 4.5–5, GPT-5.x
including Codex/mini/nano/pro variants, Gemini 2.x/3.x Flash/Pro, Grok 4.5, MAI-Code,
Kimi/Kiwi/Raptor) are already matched by existing glob patterns (
sonnet,sonnet-6x,haiku,opus,gpt-5*family aliases,gemini-*family aliases,grok,mai-code*,kimi/kiwi/raptor-mini). Existing task-oriented aliases(
coding,reasoning,summarization,vision,small/mini,large,auto)already cover the requested semantic categories. No stale patterns were found — every alias
pattern matches at least one live model, and unmatched live IDs are either deprecated or
internal/non-generation-relevant (audio, transcription, embeddings, moderation, or
experimental/codename builds not exposed for general use).
Full Model Lists by Provider
Copilot (reflect, 38): claude-haiku-4.5, claude-opus-4.6, claude-opus-4.7, claude-opus-4.8,
claude-opus-5, claude-sonnet-4.5, claude-sonnet-4.6, claude-sonnet-5, gemini-2.5-pro,
gemini-3-flash-preview, gpt-3.5-turbo, gpt-3.5-turbo-0613, gpt-4, gpt-4-0613, gpt-4-o-preview,
gpt-4.1, gpt-4.1-2025-04-14, gpt-41-copilot, gpt-4o, gpt-4o-2024-05-13, gpt-4o-2024-08-06,
gpt-4o-2024-11-20, gpt-4o-mini, gpt-4o-mini-2024-07-18, gpt-5-mini, gpt-5.3-codex, gpt-5.4,
gpt-5.4-mini, gpt-5.5, gpt-5.6-luna, gpt-5.6-sol, gpt-5.6-terra, grok-4.5,
mai-code-1-flash-picker, text-embedding-3-small, text-embedding-3-small-inference,
text-embedding-ada-002, trajectory-compaction
Copilot SDK (22): auto, claude-haiku-4.5, claude-opus-4.6, claude-opus-4.7, claude-opus-4.8,
claude-opus-5, claude-sonnet-4.5, claude-sonnet-4.6, claude-sonnet-5, gemini-3.1-pro-preview,
gemini-3.5-flash, gemini-3.6-flash, gpt-5-mini, gpt-5.3-codex, gpt-5.4, gpt-5.4-mini, gpt-5.5,
gpt-5.6-luna, gpt-5.6-sol, gpt-5.6-terra, grok-4.5, mai-code-1-flash-picker
Anthropic (10): claude-haiku-4-5-20251001, claude-opus-4-1-20250805,
claude-opus-4-5-20251101, claude-opus-4-6, claude-opus-4-7, claude-opus-4-8, claude-opus-5,
claude-sonnet-4-5-20250929, claude-sonnet-4-6, claude-sonnet-5
Gemini (50): see
/tmp/gh-aw/agent/model-inventory/artifacts/gemini-models/models.json(gemini-2.0/2.5/3/3.1/3.5/3.6 flash/pro variants, imagen-4.0, veo-3.1, lyria-3, gemma-4,
nano-banana-pro-preview, antigravity-preview, deep-research previews, computer-use preview,
robotics previews, embedding models)
OpenAI (221): see
/tmp/gh-aw/agent/model-inventory/artifacts/openai-models/models.json(gpt-5.x family incl. codex/mini/nano/pro/chat-latest, o1/o3/o4 reasoning family incl.
deep-research variants, gpt-4.1/4o legacy family, audio/realtime/transcribe/tts models,
embeddings, moderation, sora-2, and numerous internal experimental/codename builds not
intended for general workflow use)
Notes
GPT-5.x tiered pricing rows (Anthropic/Gemini/Grok/MAI-Code pricing isn't published on that
page); all extracted values match SDK/reflect/stored data exactly.
gpt-4o-mini,gpt-4.1,gpt-4o, andgpt-5.4-nanocontinue to be treated asintentionally deprecated and were excluded from gap analysis per policy.
models.jsonentries no longer returned by live APIs (e.g.claude-opus-4.5,gpt-5.2,raptor-mini,kimi-k2.7-code) were left untouched, consistent with the"no automatic removals" policy.
Warning
Firewall blocked 7 domains
The following domains were blocked by the firewall during workflow execution:
accounts.google.comandroid.clients.google.comclients2.google.comcollector.githubapp.comcontentautofill.googleapis.comsafebrowsingohttpgateway.googleapis.comwww.google.comTo allow these domains, add them to the
network.allowedlist in your workflow frontmatter:See Network Configuration for more information.