[WIP] Fix emission of --enable-chroot for awf call#15247
Merged
pelikhan merged 2 commits intofirewallv0.15.0from Feb 12, 2026
Merged
[WIP] Fix emission of --enable-chroot for awf call#15247pelikhan merged 2 commits intofirewallv0.15.0from
pelikhan merged 2 commits intofirewallv0.15.0from
Conversation
Merged
AWF v0.15.0 makes chroot mode the default behavior, so the --enable-chroot flag is no longer needed. Updated all engine files (copilot, claude, codex) and corresponding tests to reflect this change. Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Removes the deprecated --enable-chroot flag from AWF invocations and updates tests/docs to reflect AWF v0.15.0+ behavior where chroot mode is the default.
Changes:
- Removed
--enable-chrootfrom AWF argument construction in Copilot/Codex/Claude execution paths. - Updated workflow unit tests to stop expecting
--enable-chrootand instead assert AWF usage. - Updated sandbox documentation to describe chroot mode as default starting in v0.15.0+.
Reviewed changes
Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| pkg/workflow/copilot_engine_execution.go | Stop emitting --enable-chroot; update AWF/chroot-related comments. |
| pkg/workflow/codex_engine.go | Stop emitting --enable-chroot; update AWF/chroot-related comments. |
| pkg/workflow/claude_engine.go | Stop emitting --enable-chroot; update AWF/chroot-related comments (one stale reference remains elsewhere). |
| pkg/workflow/firewall_args_test.go | Update assertions to expect AWF invocation without --enable-chroot. |
| pkg/workflow/gh_cli_mount_test.go | Update chroot-mode related expectations to reflect default behavior (no flag). |
| pkg/workflow/sandbox_mounts_test.go | Update custom-mount tests to validate AWF invocation without --enable-chroot. |
| docs/src/content/docs/reference/sandbox.md | Document chroot mode as default in AWF v0.15.0+. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+273
to
276
| // Build AWF arguments: standard flags + custom args from config | ||
| // AWF v0.15.0+ uses chroot mode by default, providing transparent access to host binaries | ||
| // and environment while maintaining network isolation | ||
| var awfArgs []string |
There was a problem hiding this comment.
There’s still a comment later in this file that references --enable-chroot (around line ~357). Since this PR removes that flag for AWF v0.15.0+, please update that remaining comment to avoid misleading guidance (e.g., describe chroot mode as default and remove mention of --enable-chroot).
| if !strings.Contains(stepContent, "sudo -E awf") { | ||
| t.Error("Expected AWF command for transparent host access") | ||
| } | ||
|
|
There was a problem hiding this comment.
These tests no longer assert that --enable-chroot is absent from the generated AWF command. Since the goal of this PR is to stop emitting that flag, consider adding a negative assertion (e.g., fail if stepContent contains --enable-chroot) to prevent regressions where the flag gets reintroduced.
Suggested change
| // Ensure we are not explicitly passing the chroot flag (chroot is the default) | |
| if strings.Contains(stepContent, "--enable-chroot") { | |
| t.Error("AWF command should not include '--enable-chroot' flag when chroot mode is the default") | |
| } |
pelikhan
added a commit
that referenced
this pull request
Feb 12, 2026
* v0.15.0 * [WIP] Fix emission of --enable-chroot for awf call (#15247) * Initial plan * Remove --enable-chroot flag for awf v0.15.0 AWF v0.15.0 makes chroot mode the default behavior, so the --enable-chroot flag is no longer needed. Updated all engine files (copilot, claude, codex) and corresponding tests to reflect this change. Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> * recompile --------- Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com> Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
13 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
--enable-chrootflag from copilot_engine_execution.go--enable-chrootflag from claude_engine.go--enable-chrootflag from codex_engine.go💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.