From 58eac8c4aedcab9d5451fa7a0ccf005b2039d015 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Sat, 15 Aug 2026 18:01:51 +0000 Subject: [PATCH 1/2] docs: document cli-proxy-egress relay for DIFC credential isolation under network-isolation Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- docs/awf-config-spec.md | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/docs/awf-config-spec.md b/docs/awf-config-spec.md index 6437c6030..485ca90ea 100644 --- a/docs/awf-config-spec.md +++ b/docs/awf-config-spec.md @@ -655,6 +655,15 @@ When `security.difcProxy.host` is set, `GITHUB_TOKEN` and `GH_TOKEN` MUST be excluded from the agent environment. These tokens SHALL be held exclusively by the external DIFC proxy. +Under `--network-isolation`, the credential-bearing cli-proxy sidecar remains on +`awf-net` only. When `security.difcProxy.host` resolves to an external target +(a host address or a name outside `awf-net`'s subnet), AWF creates a separate, +credential-free `cli-proxy-egress` relay that is the only CLI-proxy component +dual-homed onto the external bridge; it forwards solely to the configured DIFC +host and port and never receives `GITHUB_TOKEN` or `GH_TOKEN`. When the DIFC +proxy is an attached sibling container already reachable on `awf-net`, no relay +is created. + ## 10. Effective Token Budget Enforcement *This section is normative.* From 1a1d9fc4bbaf71d59be3819d852bcf7f89270f07 Mon Sep 17 00:00:00 2001 From: Landon Cox Date: Sat, 15 Aug 2026 12:01:58 -0700 Subject: [PATCH 2/2] Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- docs/awf-config-spec.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/awf-config-spec.md b/docs/awf-config-spec.md index 485ca90ea..fa09dd221 100644 --- a/docs/awf-config-spec.md +++ b/docs/awf-config-spec.md @@ -656,8 +656,8 @@ be excluded from the agent environment. These tokens SHALL be held exclusively by the external DIFC proxy. Under `--network-isolation`, the credential-bearing cli-proxy sidecar remains on -`awf-net` only. When `security.difcProxy.host` resolves to an external target -(a host address or a name outside `awf-net`'s subnet), AWF creates a separate, +`awf-net` only. When `security.difcProxy.host` is classified as external +(`host.docker.internal`, an IP address outside `awf-net`'s subnet, or a dotted DNS name), AWF creates a separate, credential-free `cli-proxy-egress` relay that is the only CLI-proxy component dual-homed onto the external bridge; it forwards solely to the configured DIFC host and port and never receives `GITHUB_TOKEN` or `GH_TOKEN`. When the DIFC