feat: default to strict security mode, stop injecting sudo and --enable-host-access

.github/workflows/smoke-service-ports.md

@@ -16,6 +16,9 @@ permissions:
 name: Smoke Service Ports
 engine: copilot
 strict: true
+sandbox:
+  agent:
+    legacy-security: enable
 services:
   redis:
     image: redis:7
@@ -53,7 +56,7 @@ features:
 
 # Smoke Test: Service Ports (Redis)
 
-**Purpose:** Validate that the `--allow-host-service-ports` feature works end-to-end. The compiler should have automatically detected the Redis service port and configured AWF to allow traffic to it.
+**Purpose:** Validate that the `--allow-host-service-ports` feature works end-to-end. This workflow opts into `legacy-security: enable` so the compiler can configure AWF to allow traffic to the Redis service port.
 
 **IMPORTANT:** Inside AWF's sandbox, you must connect to services via `host.docker.internal` (not `localhost`). The service containers run on the host, and AWF routes traffic through the host gateway. Since the workflow maps port 6379:6379, port 6379 should work. Keep all outputs concise.
 

pkg/cli/compile_service_ports_integration_test.go

@@ -13,6 +13,7 @@ import (
 // TestCompileServicePortsWorkflow compiles the canonical test-service-ports.md workflow
 // and verifies that the generated lock file contains --allow-host-service-ports with the
 // correct ${{ job.services['<id>'].ports['<port>'] }} expressions for every service port.
+// The fixture opts into legacy-security because service-port passthrough requires host access.
 func TestCompileServicePortsWorkflow(t *testing.T) {
 	setup := setupIntegrationTest(t)
 	defer setup.cleanup()
@@ -99,6 +100,57 @@ This workflow has no services block and should not include --allow-host-service-
 	}
 }
 
+// TestCompileServicePorts_StrictModeWithServices verifies that workflows with services
+// still compile in strict mode, but do not emit --allow-host-service-ports unless they
+// opt into legacy-security: enable.
+func TestCompileServicePorts_StrictModeWithServices(t *testing.T) {
+	setup := setupIntegrationTest(t)
+	defer setup.cleanup()
+
+	testWorkflow := `---
+on:
+  workflow_dispatch:
+permissions:
+  contents: read
+engine: copilot
+services:
+  redis:
+    image: redis:7
+    ports:
+      - 6379:6379
+---
+
+# Strict Services Workflow
+
+This workflow has services but omits legacy-security: enable, so it should not include
+--allow-host-service-ports.
+`
+	testPath := filepath.Join(setup.workflowsDir, "strict-services.md")
+	if err := os.WriteFile(testPath, []byte(testWorkflow), 0644); err != nil {
+		t.Fatalf("Failed to write workflow: %v", err)
+	}
+
+	cmd := exec.Command(setup.binaryPath, "compile", testPath)
+	output, err := cmd.CombinedOutput()
+	if err != nil {
+		t.Fatalf("Compile failed: %v\nOutput: %s", err, string(output))
+	}
+
+	lockFilePath := filepath.Join(setup.workflowsDir, "strict-services.lock.yml")
+	lockContent, err := os.ReadFile(lockFilePath)
+	if err != nil {
+		t.Fatalf("Failed to read lock file: %v", err)
+	}
+
+	lock := string(lockContent)
+	if strings.Contains(lock, "--allow-host-service-ports") {
+		t.Errorf("Lock file should NOT contain --allow-host-service-ports in strict mode\nLock content:\n%s", lock)
+	}
+	if strings.Contains(lock, "job.services['redis'].ports['6379']") {
+		t.Errorf("Lock file should NOT contain service-port expressions in strict mode\nLock content:\n%s", lock)
+	}
+}
+
 // TestCompileServicePorts_HyphenatedServiceID verifies that service IDs containing
 // hyphens are emitted with bracket notation (not dot notation) in the compiled lock file.
 func TestCompileServicePorts_HyphenatedServiceID(t *testing.T) {
@@ -111,6 +163,9 @@ on:
 permissions:
   contents: read
 engine: copilot
+sandbox:
+  agent:
+    legacy-security: enable
 services:
   my-postgres:
     image: postgres:15

pkg/cli/workflows/test-service-ports.md

@@ -4,6 +4,9 @@ on:
 permissions:
   contents: read
 engine: copilot
+sandbox:
+  agent:
+    legacy-security: enable
 services:
   postgres:
     image: postgres:15
@@ -17,8 +20,9 @@ services:
 
 # Test Service Ports
 
-This workflow tests that the compiler automatically generates `--allow-host-service-ports`
-from `services:` port mappings.
+This workflow tests that the compiler generates `--allow-host-service-ports`
+from `services:` port mappings when `legacy-security: enable` opts AWF into
+host-access mode.
 
 Expected: the compiled lock file includes `--allow-host-service-ports` with expressions for
 both PostgreSQL (port 5432) and Redis (port 6379).

pkg/constants/constants.go

@@ -150,8 +150,13 @@ const OTELSentryEndpointSecretName = "GH_AW_OTEL_SENTRY_ENDPOINT"
 
 // AWF (Agentic Workflow Firewall) constants
 
-// AWFDefaultCommand is the default AWF command prefix
-const AWFDefaultCommand = "sudo -E awf"
+// AWFDefaultCommand is the default AWF command prefix.
+// Strict security (no sudo) is the default since AWF v0.27.32.
+const AWFDefaultCommand = "awf"
+
+// AWFLegacySecurityCommand is the AWF command prefix for legacy security mode.
+// Used when legacy-security: enable is set in frontmatter.
+const AWFLegacySecurityCommand = "sudo -E awf"
 
 // AWFProxyLogsDir is the default directory for AWF proxy logs
 const AWFProxyLogsDir = "/tmp/gh-aw/sandbox/firewall/logs"

pkg/constants/constants_test.go

@@ -118,7 +118,7 @@ func TestConstantValues(t *testing.T) {
 		{"CLIExtensionPrefix", string(CLIExtensionPrefix), "gh aw"},
 		{"DefaultMCPRegistryURL", string(DefaultMCPRegistryURL), "https://api.mcp.github.com/v0.1"},
 		{"OTELSentryEndpointSecretName", OTELSentryEndpointSecretName, "GH_AW_OTEL_SENTRY_ENDPOINT"},
-		{"AWFDefaultCommand", AWFDefaultCommand, "sudo -E awf"},
+		{"AWFDefaultCommand", AWFDefaultCommand, "awf"},
 		{"AWFProxyLogsDir", AWFProxyLogsDir, "/tmp/gh-aw/sandbox/firewall/logs"},
 		{"AWFAuditDir", AWFAuditDir, "/tmp/gh-aw/sandbox/firewall/audit"},
 		{"PreAgentAuditFilePath", PreAgentAuditFilePath, "/tmp/gh-aw/pre-agent-audit.txt"},

pkg/constants/spec_test.go

@@ -508,9 +508,9 @@ func TestSpec_URLConstants_Values(t *testing.T) {
 // TestSpec_AWFConstants_Values validates the documented AWF constants.
 // Spec section: "## AWF (Agentic Workflow Firewall) Constants"
 func TestSpec_AWFConstants_Values(t *testing.T) {
-	// From spec: AWFDefaultCommand // "sudo -E awf"
-	assert.Equal(t, "sudo -E awf", constants.AWFDefaultCommand,
-		"AWFDefaultCommand should be 'sudo -E awf' as documented")
+	// From spec: AWFDefaultCommand // "awf" (strict mode default; legacy mode uses AWFLegacySecurityCommand)
+	assert.Equal(t, "awf", constants.AWFDefaultCommand,
+		"AWFDefaultCommand should be 'awf' for strict security mode")
 
 	// From spec: AWFProxyLogsDir // "/tmp/gh-aw/sandbox/firewall/logs"
 	assert.Equal(t, "/tmp/gh-aw/sandbox/firewall/logs", constants.AWFProxyLogsDir,

pkg/constants/version_constants.go

@@ -73,7 +73,7 @@ const DefaultGitHubMCPServerVersion Version = "v1.5.0"
 //
 // The first recompile regenerates all lock files using the new version; the second recompile
 // refreshes the container SHA pins that were resolved during the first pass.
-const DefaultFirewallVersion Version = "v0.27.31"
+const DefaultFirewallVersion Version = "v0.27.32"
 
 // AWFExcludeEnvMinVersion is the minimum AWF version that supports the --exclude-env flag.
 // Workflows pinning an older AWF version must not emit --exclude-env flags or the run will fail.
@@ -114,6 +114,11 @@ const AWFArcDindMinVersion Version = "v0.27.20"
 // containerRuntime field in the container config (gh-aw-firewall#6093).
 const AWFContainerRuntimeMinVersion Version = "v0.27.30"
 
+// AWFLegacySecurityMinVersion is the minimum AWF version that supports the
+// --legacy-security flag and unconditional API proxy (gh-aw-firewall#6207).
+// Workflows pinning an older AWF version must use the old --security-mode compat behavior.
+const AWFLegacySecurityMinVersion Version = "v0.27.32"
+
 // DefaultGVisorVersion is the pinned gVisor release used by the compiler-generated
 // install step. A specific dated release name is used instead of "latest" to ensure
 // reproducible, verifiable installs. Each release provides SHA-512 files for

pkg/parser/schemas/main_workflow_schema.json

@@ -3528,6 +3528,11 @@
                         }
                       },
                       "additionalProperties": false
+                    },
+                    "legacy-security": {
+                      "type": "string",
+                      "enum": ["enable"],
+                      "description": "Opt into legacy security mode. When set to 'enable', AWF runs with sudo and --enable-host-access for backward compatibility. The default (omitted) uses strict security mode where AWF runs rootless without host-access flags."
                     }
                   },
                   "additionalProperties": false

pkg/workflow/agentic_output_test.go

@@ -391,7 +391,7 @@ func TestClaudeEngineNetworkHookCleanup(t *testing.T) {
 		result := allStepsStr.String()
 
 		// Verify AWF is used instead of hooks
-		if !strings.Contains(result, "sudo -E awf") {
+		if !strings.Contains(result, "awf") {
 			t.Error("Expected AWF wrapper to be used with network permissions")
 		}
 
@@ -483,7 +483,7 @@ func TestClaudeEngineNetworkHookCleanup(t *testing.T) {
 		result := allStepsStr.String()
 
 		// Verify AWF is used
-		if !strings.Contains(result, "sudo -E awf") {
+		if !strings.Contains(result, "awf") {
 			t.Error("Expected AWF to be used even with deny-all policy")
 		}
 

pkg/workflow/awf_config.go

@@ -218,10 +218,12 @@ type AWFPlatformConfig struct {
 }
 
 // AWFAPIProxyConfig is the "apiProxy" section of the AWF config file.
-// It maps to the --enable-api-proxy and --*-api-target CLI flags.
+// It maps to the apiProxy.* fields in the AWF config schema.
+// Note: --enable-api-proxy is deprecated since AWF v0.27.32 (API proxy is always on).
 type AWFAPIProxyConfig struct {
 	// Enabled enables the API proxy sidecar for LLM gateway credential isolation.
-	// Maps to: --enable-api-proxy
+	// Since AWF v0.27.32, the API proxy is always enabled; this field is kept
+	// for backward compatibility with older AWF versions.
 	Enabled bool `json:"enabled"`
 
 	// EnableTokenSteering enables budget-warning system message injection near ET budget exhaustion.

pkg/workflow/awf_config_test.go

@@ -1443,7 +1443,7 @@ func TestBuildAWFCommand_ConfigFileWithPathSetup(t *testing.T) {
 	pathSetupIdx := strings.Index(command, "GH_AW_NODE_BIN")
 	configWriteIdx := strings.Index(command, "awf-config.json")
 	modelsPathIdx := strings.Index(command, "GH_AW_MODELS_JSON_PATH")
-	awfIdx := strings.Index(command, "sudo -E awf")
+	awfIdx := strings.Index(command, "awf ")
 
 	assert.GreaterOrEqual(t, pathSetupIdx, 0, "path setup should appear in command")
 	assert.GreaterOrEqual(t, configWriteIdx, 0, "config file write should appear in command")
@@ -1548,7 +1548,7 @@ func TestBuildAWFCommand_WritesAgentCLIStartTimestamp(t *testing.T) {
 			// The timestamp write must appear before the AWF invocation so it captures
 			// the step start time rather than the time after AWF container setup.
 			tsIdx := strings.Index(command, AgentCLIStartMsPath)
-			awfIdx := strings.Index(command, "sudo -E awf")
+			awfIdx := strings.Index(command, "awf ")
 			assert.Less(t, tsIdx, awfIdx,
 				"timestamp write must appear before AWF invocation")
 

pkg/workflow/awf_helpers.go

@@ -420,13 +420,18 @@ fi`,
 	}
 
 	// Add --allow-host-service-ports for services with port mappings.
+	// This flag requires --legacy-security since it grants host network access.
 	// This is appended as a raw (expandable) arg because the value contains
 	// ${{ job.services.<id>.ports['<port>'] }} expressions that include single quotes.
 	// These expressions are resolved by the GitHub Actions runner before shell execution,
 	// so they must not be shell-escaped.
-	if config.WorkflowData != nil && config.WorkflowData.ServicePortExpressions != "" {
+	agentCfg := getAgentConfig(config.WorkflowData)
+	isLegacyMode := agentCfg != nil && agentCfg.LegacySecurity
+	if config.WorkflowData != nil && config.WorkflowData.ServicePortExpressions != "" && isLegacyMode {
 		expandableArgs += fmt.Sprintf(` --allow-host-service-ports "%s"`, config.WorkflowData.ServicePortExpressions)
 		awfHelpersLog.Printf("Added --allow-host-service-ports with %s", config.WorkflowData.ServicePortExpressions)
+	} else if config.WorkflowData != nil && config.WorkflowData.ServicePortExpressions != "" {
+		awfHelpersLog.Print("Skipping --allow-host-service-ports: requires legacy-security mode")
 	}
 
 	engineCommand := config.EngineCommand
@@ -586,13 +591,15 @@ fi`,
 // The following flags are expressed in the generated JSON config file written by
 // BuildAWFCommand and are therefore not emitted here:
 //   - --allow-domains / --block-domains   → network.allowDomains / network.blockDomains
-//   - --enable-api-proxy                  → apiProxy.enabled
 //   - --image-tag                         → container.imageTag
 //   - --openai-api-target                 → apiProxy.targets.openai.host
 //   - --anthropic-api-target              → apiProxy.targets.anthropic.host
 //   - --copilot-api-target                → apiProxy.targets.copilot.host
 //   - --gemini-api-target                 → apiProxy.targets.gemini.host
 //
+// Note: --enable-api-proxy is deprecated in AWF v0.27.32+ (API proxy is always on).
+// The apiProxy.enabled field is still emitted in the config file for backward compat.
+//
 // Parameters:
 //   - config: AWF command configuration
 //
@@ -672,17 +679,21 @@ func BuildAWFArgs(config AWFCommandConfig) []string {
 		awfHelpersLog.Print("Added --diagnostic-logs because awf-diagnostic-logs feature flag is enabled")
 	}
 
-	if isAWFNetworkIsolationEnabled(config.WorkflowData) {
-		awfHelpersLog.Print("Skipping host-access flags: sandbox.agent.sudo is false (network isolation mode)")
-	} else {
-		// Always add --enable-host-access: needed for the API proxy sidecar
-		// (to reach host.docker.internal:<port>) and for MCP gateway communication
+	// Legacy security mode: emit --legacy-security, --enable-host-access, and --allow-host-ports
+	isLegacy := agentConfig != nil && agentConfig.LegacySecurity
+	if isLegacy {
+		if awfSupportsLegacySecurity(firewallConfig) {
+			awfArgs = append(awfArgs, "--legacy-security")
+			awfHelpersLog.Print("Added --legacy-security (legacy-security: enable in frontmatter)")
+		} else {
+			// AWF versions older than v0.27.32 don't support --legacy-security;
+			// they run in legacy mode by default so the flag is unnecessary.
+			awfHelpersLog.Printf("Skipping --legacy-security: AWF version %q is older than minimum %s (legacy mode is the default for older versions)", getAWFImageTag(firewallConfig), constants.AWFLegacySecurityMinVersion)
+		}
+
 		awfArgs = append(awfArgs, "--enable-host-access")
-		awfHelpersLog.Print("Added --enable-host-access for API proxy and MCP gateway")
+		awfHelpersLog.Print("Added --enable-host-access for legacy security mode")
 
-		// AWF's --enable-host-access defaults to ports 80,443. The MCP gateway now
-		// listens on port 8080 (non-privileged), so we must explicitly allow it
-		// when AWF supports --allow-host-ports.
 		if awfSupportsAllowHostPorts(firewallConfig) {
 			mcpGatewayPort := int(DefaultMCPGatewayPort)
 			if config.WorkflowData != nil && config.WorkflowData.SandboxConfig != nil &&
@@ -691,10 +702,10 @@ func BuildAWFArgs(config AWFCommandConfig) []string {
 			}
 			hostPorts := fmt.Sprintf("80,443,%d", mcpGatewayPort)
 			awfArgs = append(awfArgs, "--allow-host-ports", hostPorts)
-			awfHelpersLog.Printf("Added --allow-host-ports %s for MCP gateway access", hostPorts)
-		} else {
-			awfHelpersLog.Printf("Skipping --allow-host-ports: AWF version %q requires at least %s", getAWFImageTag(firewallConfig), constants.AWFAllowHostPortsMinVersion)
+			awfHelpersLog.Printf("Added --allow-host-ports %s for legacy security mode", hostPorts)
 		}
+	} else {
+		awfHelpersLog.Print("Strict security: skipping host-access flags (default)")
 	}
 
 	// Skip pulling images since they are pre-downloaded
@@ -780,14 +791,14 @@ func GetAWFCommandPrefix(workflowData *WorkflowData) string {
 		return agentConfig.Command
 	}
 
-	// When sudo is false (network isolation mode), AWF runs rootless: no sudo needed.
-	// Strip the "sudo -E " prefix from the default command to get the base binary name.
-	if isAWFNetworkIsolationEnabled(workflowData) {
-		awfHelpersLog.Print("Using rootless AWF command (sudo: false, network isolation mode)")
-		return strings.TrimPrefix(string(constants.AWFDefaultCommand), "sudo -E ")
+	// Legacy security mode: use sudo for backward compatibility
+	if agentConfig != nil && agentConfig.LegacySecurity {
+		awfHelpersLog.Print("Using legacy AWF command (legacy-security: enable)")
+		return string(constants.AWFLegacySecurityCommand)
 	}
 
-	awfHelpersLog.Print("Using standard AWF command")
+	// Default strict security: AWF runs rootless (no sudo)
+	awfHelpersLog.Print("Using standard AWF command (strict security, no sudo)")
 	return string(constants.AWFDefaultCommand)
 }
 
@@ -1043,6 +1054,13 @@ func awfSupportsContainerRuntime(firewallConfig *FirewallConfig) bool {
 	return awfVersionAtLeast(firewallConfig, constants.AWFContainerRuntimeMinVersion)
 }
 
+// awfSupportsLegacySecurity returns true when the effective AWF version supports the
+// --legacy-security flag (v0.27.32+). Older versions default to legacy mode and do not
+// recognize this flag.
+func awfSupportsLegacySecurity(firewallConfig *FirewallConfig) bool {
+	return awfVersionAtLeast(firewallConfig, constants.AWFLegacySecurityMinVersion)
+}
+
 // buildArcDindChrootConfigPatchBody returns the Node.js command that patches the AWF
 // config file with chroot.binariesSourcePath and chroot.identity.*. It is designed to be
 // embedded inside a bash if-block that already guards on DOCKER_HOST=tcp://...