fix: propagate apiProxy.diagnostics config fields to all layers

src/config-file.ts

@@ -55,6 +55,10 @@ interface AwfFileConfig {
       debugTokens?: boolean;
       tokenLogDir?: string;
     };
+    diagnostics?: {
+      captureBlockedRequests?: boolean | 'summary' | 'redacted' | 'full';
+      maxCapturedBytes?: number;
+    };
     auth?: {
       anthropicTokenUrl?: string;
     };
@@ -246,6 +250,8 @@ export function mapAwfFileConfigToCliOptions(config: AwfFileConfig): Record<stri
     modelAliases: config.apiProxy?.models,
     debugTokens: config.apiProxy?.logging?.debugTokens,
     tokenLogDir: config.apiProxy?.logging?.tokenLogDir,
+    captureBlockedRequests: config.apiProxy?.diagnostics?.captureBlockedRequests,
+    maxCapturedBytes: config.apiProxy?.diagnostics?.maxCapturedBytes,
     anthropicTokenUrl: config.apiProxy?.auth?.anthropicTokenUrl,
 
     sslBump: config.security?.sslBump,

src/services/api-proxy-service-config.ts

@@ -192,6 +192,14 @@ export function buildApiProxyServiceConfig(params: ApiProxyServiceConfigParams):
       // Token and model-alias diagnostic logging
       ...(config.debugTokens && { AWF_DEBUG_TOKENS: '1' }),
       ...(config.tokenLogDir && { AWF_TOKEN_LOG_DIR: config.tokenLogDir }),
+      // Blocked-request diagnostics
+      ...(config.captureBlockedRequests !== undefined &&
+        config.captureBlockedRequests !== false && {
+          AWF_CAPTURE_BLOCKED_LLM_REQUESTS: String(config.captureBlockedRequests),
+        }),
+      ...(config.maxCapturedBytes !== undefined && {
+        AWF_MAX_BLOCKED_CAPTURE_BYTES: String(config.maxCapturedBytes),
+      }),
       // OIDC authentication (Azure, AWS, GCP, Anthropic)
       ...pickEnvVars(
         'AWF_AUTH_TYPE',

src/types/api-proxy-options.ts

@@ -475,6 +475,34 @@ export interface ApiProxyOptions {
    */
   tokenLogDir?: string;
 
+  /**
+   * Enable capture of body-shape diagnostics for guard-blocked requests.
+   *
+   * - `false` (default): Nothing written.
+   * - `'summary'`: Counts, sizes, hashes — no message content.
+   * - `'redacted'`: Summary plus first 200 chars per message.
+   * - `'full'`: Full body up to `maxCapturedBytes`.
+   * - `true`: Alias for `'summary'`.
+   *
+   * Set via:
+   * - Config file: `apiProxy.diagnostics.captureBlockedRequests: "summary"`
+   * - Environment variable: `AWF_CAPTURE_BLOCKED_LLM_REQUESTS=summary`
+   *
+   * @default false
+   */
+  captureBlockedRequests?: boolean | 'summary' | 'redacted' | 'full';
+
+  /**
+   * Maximum body bytes to include in a single `full`-mode blocked-request-diag record.
+   *
+   * Set via:
+   * - Config file: `apiProxy.diagnostics.maxCapturedBytes: 250000`
+   * - Environment variable: `AWF_MAX_BLOCKED_CAPTURE_BYTES=250000`
+   *
+   * @default 250000
+   */
+  maxCapturedBytes?: number;
+
   /**
    * Enable Anthropic prompt-cache optimizations in the API proxy sidecar.
    *