[WIP] Fix squid aborts on client disconnection during CONNECT by Copilot · Pull Request #9419 · github/gh-aw-firewall

Copilot · 2026-10-03T16:54:35Z

Inspect Squid configuration, image build, issue update, and test infrastructure
Disable unsafe half-closed client handling and ship the Squid empty-buffer guard
Add focused CONNECT EOF regression coverage and verify streaming compatibility
Run targeted tests, build/lint checks, secret scan, and code/security review

Fixes [awf] squid aborts (assertion !inBuf.isEmpty(), client_side.cc:2829) when a client closes after CONNECT and before its TLS ClientHello; root cause of #9088 #9404

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

lpcox · 2026-10-04T03:39:52Z

@copilot finish implementing this pr

Copilot · 2026-10-04T04:06:36Z

@copilot finish implementing this pr

Completed and pushed the remaining regression coverage; the patched Squid image built successfully, and the CONNECT EOF integration test passed while preserving streaming timeout settings. Commit: a64a9d7.

Copilot

Copilot review overview

🟡 Changes recommended

The downstream Squid guard lacks regression coverage that exercises it independently of the configuration workaround.

Review effort: Balanced
Findings: 1

Open (1)

Test the EOF guard with half_closed_clients enabled · New

What changed in this PR

Adds layered protection against Squid crashes when CONNECT clients disconnect before sending TLS ClientHello data.

Changes:

Disables unsafe half-closed client handling.
Patches Squid’s empty-buffer assertion path.
Adds configuration and integration regression coverage.

File	Description
`tests/integration/network-security.test.ts`	Tests CONNECT EOF handling and Squid stability.
`src/squid/config-generator.ts`	Disables half-closed clients.
`src/squid-config-streaming.test.ts`	Verifies generated configuration.
`containers/squid/Dockerfile`	Builds and installs patched Squid.
`containers/squid/clienthello-eof.patch`	Guards empty ClientHello buffers.
`.github/workflows/test-squid-image.yml`	Extends image-build timeout.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

+    if (inBuf.isEmpty()) {
+        debugs(83, 3, "client EOF before TLS ClientHello: " << clientConnection);
+        clientConnection->close();
+        return;


lpcox · 2026-10-04T15:50:49Z

@copilot address review feedback

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot · 2026-10-04T16:04:37Z

@copilot address review feedback

Added independent image-matrix coverage with SSL bump active and half_closed_clients on; the pre-ClientHello close/half-close cases passed against the patched image. Commit: 20117f0.

github-actions · 2026-10-04T16:05:06Z

✅ Copilot review passed with no inline comments.

@copilot Add the ready-for-aw label to this PR to trigger agentic CI smoke tests.

github-actions · 2026-10-04T16:09:49Z

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	92.65%	92.91%	📈 +0.26%
Statements	91.13%	91.39%	📈 +0.26%
Functions	89.28%	89.56%	📈 +0.28%
Branches	84.87%	85.03%	📈 +0.16%

📁 Per-file Coverage Changes (8 files)

File	Lines (Before → After)	Statements (Before → After)
`src/nvx/one-shot-adapter.ts`	83.5% → 82.9% (-0.60%)	80.3% → 79.8% (-0.56%)
`src/cloud-hypervisor/host-enclave-executor.ts`	95.1% → 94.5% (-0.57%)	91.5% → 89.8% (-1.64%)
`src/enclave/host-executor-server.ts`	90.3% → 90.3% (+0.00%)	88.8% → 89.1% (+0.31%)
`src/enclave/cloud-hypervisor-lifecycle.ts`	92.9% → 94.7% (+1.77%)	90.8% → 92.3% (+1.54%)
`src/enclave/paths.ts`	97.2% → 100.0% (+2.78%)	97.2% → 100.0% (+2.78%)
`src/log-directory-setup.ts`	96.8% → 100.0% (+3.18%)	96.9% → 100.0% (+3.13%)
`src/bounded-execution/repository-staging.ts`	80.0% → 100.0% (+20.00%)	80.0% → 100.0% (+20.00%)
`src/enclave/manager.ts`	59.3% → 86.4% (+27.12%)	57.9% → 85.2% (+27.32%)

✨ New Files (2 files)

src/cloud-hypervisor/enclave-artifact-preflight.ts: 97.6% lines
src/cloud-hypervisor/enclave-invocation-staging.ts: 95.7% lines

Coverage comparison generated by scripts/ci/compare-coverage.ts

lpcox · 2026-10-04T16:22:58Z

@copilot fix the pr title and summary and fix this failing ci check https://github.com/github/gh-aw-firewall/actions/runs/37215276207/job/111474869658?pr=9419

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot · 2026-10-04T16:39:10Z

@copilot fix the pr title and summary and fix this failing ci check https://github.com/github/gh-aw-firewall/actions/runs/37215276207/job/111474869658?pr=9419

The CI test fix is committed as 9199122; the patched-image CONNECT EOF regression now passes locally. The available tools do not support editing the PR title or body, so those remain unchanged.

github-actions · 2026-10-04T17:19:41Z

🔌 Smoke Services — All services reachable! ✅

🔌 Service connectivity validated by Smoke Services

github-actions · 2026-10-04T17:19:41Z

❌ Smoke Copilot BYOK AOAI (api-key) reports failed. AOAI BYOK (api-key) mode investigation needed...

🔑 BYOK (AOAI api-key) report filed by Smoke Copilot BYOK AOAI (api-key)

github-actions · 2026-10-04T17:19:41Z

❌ Smoke Gemini reports failed. Facets need polishing...

💎 Faceted by Smoke Gemini

github-actions · 2026-10-04T17:19:42Z

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

📰 BREAKING: Report filed by Smoke Copilot

github-actions · 2026-10-04T17:19:42Z

Smoke Cloud Hypervisor completed. Cloud Hypervisor + Copilot passed.

smoke test checks could not run: curl, python3, node, and the github/safeoutputs CLI bridges are all blocked by Permission denied in this sandbox

Cloud Hypervisor + Copilot smoke test by Smoke Cloud Hypervisor

github-actions · 2026-10-04T17:19:43Z

🛡️ Smoke Copilot Network Isolation confirmed the egress allowlist is enforced. ✅

🛡️ Egress verdict from Smoke Copilot Network Isolation

github-actions · 2026-10-04T17:19:44Z

✅ Smoke Claude passed

Generated by Smoke Claude for #9419

github-actions · 2026-10-04T17:19:45Z

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

🔮 The oracle has spoken through Smoke Codex

github-actions · 2026-10-04T17:19:46Z

✅ Build Test Suite completed successfully!

Generated by Build Test Suite for #9419

github-actions · 2026-10-04T17:19:55Z

📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅

📡 OTel tracing validated by Smoke OTel Tracing

github-actions · 2026-10-04T17:29:09Z

Smoke Copilot: PASS

✅ GitHub MCP: "Upgrade gh-aw prerelease workflows"
✅ github.com HTTP 200
✅ File write/read
Author @Copilot; assignees @lpcox @Copilot

📰 BREAKING: Report filed by Smoke Copilot
_{Add label ready-for-aw to run again}

github-actions · 2026-10-04T17:29:16Z

Smoke Claude Results

API status: ✅ PASS
GitHub check: ✅ PASS
File status: ✅ PASS

Overall result: PASS

Generated by Smoke Claude for #9419 · claude · haiku45 · 49.9 AIC · ⊞ 6.2K · ◷
_{Add label ready-for-aw to run again}

github-actions · 2026-10-04T17:29:28Z

Services smoke test:

Redis PING: ✅ PONG
pg_isready: ✅ accepting connections
psql SELECT 1: ✅ 1

Overall: PASS

🔌 Service connectivity validated by Smoke Services
_{Add label ready-for-aw to run again}

github-actions · 2026-10-04T17:29:51Z

Smoke Test: Copilot BYOK (Direct) Mode ✅

Test Results:

✅ GitHub MCP: Fetched 2 merged PRs (Upgrade gh-aw prerelease workflows #9435, fix(ci): pin tsx for docs audit enforcement #9430)
✅ GitHub.com: HTTP 200
✅ File Write/Read: /tmp/gh-aw/agent/smoke-test-copilot-byok.txt exists
✅ BYOK Inference: Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY) via api-proxy → api.githubcopilot.com

Status: PASS — All smoke tests passed. Direct BYOK mode operational.

🔑 BYOK report filed by Smoke Copilot BYOK
_{Add label ready-for-aw to run again}

github-actions · 2026-10-04T17:29:52Z

EGRESS_RESULT allow=pass deny=pass

✅ Allowed domain (api.github.com → 200)
✅ Blocked domain (example.com blocked)
Overall: PASS — @Copilot

🛡️ Egress verdict from Smoke Copilot Network Isolation
_{Add label ready-for-aw to run again}

github-actions · 2026-10-04T17:30:17Z

Smoke Test: Cloud Hypervisor + Copilot

List merged PRs (github MCP) - FAIL (tool invocation intermittently denied by sandbox exec policy)
curl https://github.com - FAIL (curl execution denied before reaching network/firewall)
Write/read /tmp/gh-aw/agent/smoke file - PASS
curl (example.com/redacted) (expect blocked) - FAIL (could not execute curl)

Most checks could not run because curl, python3, node, jq, and the github CLI bridge were intermittently blocked by the sandbox exec policy itself ("Permission denied") before any firewall logic was reached. Only the local file write/read check passed. Label not added since not all checks passed.

Cloud Hypervisor + Copilot smoke test by Smoke Cloud Hypervisor
_{Add label ready-for-aw to run again}

github-actions · 2026-10-04T17:30:41Z

OTEL smoke test

✅ 1 Module loading: otel.js loads; exports startRequestSpan, setTokenAttributes, setBudgetAttributes, endSpan, endSpanError, shutdown, isEnabled (+ internals)
✅ 2 Tests: otel.test.js 39/39 passed
✅ 3 Env forwarding: trace/parent span IDs in env-passthrough.ts; OTEL vars in api-proxy-env-config.ts
✅ 4 Token tracker: onUsage hook present in token-tracker-http.js
✅ 5 Diagnostics: /tmp/gh-aw/otel.jsonl has 1 record (no api-proxy spans expected in this run)

📡 OTel tracing validated by Smoke OTel Tracing
_{Add label ready-for-aw to run again}

github-actions · 2026-10-04T17:30:54Z

Chroot Version Comparison

Runtime	Host Version	Chroot Version	Match?
Python	Python 3.12.14	Python 3.12.14	✅ YES
Node.js	v24.21.0	v22.23.2	❌ NO
Go	go1.22.12	go1.22.12	✅ YES

Result: Not all tests passed (Node.js version mismatch), so the smoke-chroot label was not added.

Tested by Smoke Chroot
_{Add label ready-for-aw to run again}

github-actions · 2026-10-04T17:30:55Z

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	❌	not run	❌ FAIL
Bun	hono	❌	not run	❌ FAIL
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	❌	not run	❌ FAIL
Deno	std	❌	not run	❌ FAIL
.NET	hello-world	✅	N/A	✅ PASS
.NET	json-parse	✅	N/A	✅ PASS
Go	color	✅	pass	✅ PASS
Go	env	✅	pass	✅ PASS
Go	uuid	✅	pass	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS*
Java	caffeine	✅	1/1 passed	✅ PASS*
Node.js	clsx	✅	pass	✅ PASS
Node.js	execa	✅	pass	✅ PASS
Node.js	p-limit	✅	pass	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 6/8 ecosystems passed — FAIL

Failures

Bun / Deno: the install scripts (curl ... | bash / | sh) were rejected with "Permission denied and could not request permission from user", so neither runtime could be installed. Neither is on PATH, so their tests were not run.
*Java: the default ~/.m2/repository could not be created ("Could not create local repository"). Both projects passed after I reran with -Dmaven.repo.local pointing to a writable temp directory.

All 8 repositories cloned successfully. The build-test label was not added because of the failures.

Generated by Build Test Suite for #9419 · copilot · auto · 27.5 AIC · ⊞ 11.8K · ◷
_{Add label ready-for-aw to run again}

github-actions · 2026-10-04T17:31:00Z

Smoke Test

Last 2 merged PRs: ❌
2 PR details: ❌
Playwright GitHub title: ❌
Temp file write/read: ❌
AWF build: ❌
Overall: FAIL

PR titles unavailable because the runner shell lacked required tools (gh, coreutils, safeoutputs on PATH).

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

Initial plan

9a930cf

Copilot AI assigned Copilot and lpcox Oct 3, 2026

Copilot started work on behalf of lpcox October 3, 2026 16:54 View session

Copilot AI linked an issue Oct 3, 2026 that may be closed by this pull request

[awf] squid aborts (assertion !inBuf.isEmpty(), client_side.cc:2829) when a client closes after CONNECT and before its TLS ClientHello; root cause of #9088 #9404

Closed

fix: prevent Squid crashes on EOF before TLS ClientHello

d091c7c

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot stopped work on behalf of lpcox due to an error October 3, 2026 17:09
Execution failed: CAPIError: 422 This content was flagged for possible cybersecurity risk. If this seems wrong, try rephrasing your request. If you’re doing authorized security work that requires more...

Copilot AI requested a review from lpcox October 3, 2026 17:09

Copilot started work on behalf of lpcox October 4, 2026 03:40 View session

Copilot AI added 2 commits October 4, 2026 03:44

test: clean up Squid EOF regression changes

c91f630

test: use numeric proxy endpoint in EOF regression

a64a9d7

Copilot finished work on behalf of lpcox October 4, 2026 04:07

lpcox marked this pull request as ready for review October 4, 2026 15:44

Copilot AI balanced review requested due to automatic review settings October 4, 2026 15:44

Copilot started reviewing on behalf of lpcox October 4, 2026 15:45 View session

Copilot AI reviewed Oct 4, 2026

View reviewed changes

Comment thread containers/squid/clienthello-eof.patch

Comment on lines +5 to +8

+ if (inBuf.isEmpty()) {

+ debugs(83, 3, "client EOF before TLS ClientHello: " << clientConnection);

+ clientConnection->close();

+ return;

Copilot started work on behalf of lpcox October 4, 2026 15:51 View session

test: cover Squid EOF guard with half-closed clients enabled

20117f0

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot finished work on behalf of lpcox October 4, 2026 16:05

Copilot started work on behalf of lpcox October 4, 2026 16:23 View session

test: stabilize CONNECT EOF regression

9199122

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot finished work on behalf of lpcox October 4, 2026 16:39

lpcox had a problem deploying to aoai-model October 4, 2026 17:19 — with GitHub Actions Failure

github-actions Bot added the smoke-copilot label Oct 4, 2026

github-actions Bot added the smoke-claude label Oct 4, 2026

github-actions Bot added the smoke-services label Oct 4, 2026

lpcox deployed to aoai-model October 4, 2026 17:29 — with GitHub Actions Active

github-actions Bot added smoke-copilot-byok smoke-copilot-network-isolation Copilot network-isolation egress smoke test labels Oct 4, 2026

lpcox merged commit 14d0b4f into main Oct 4, 2026
132 of 137 checks passed

lpcox deleted the copilot/awf-squid-aborts-issue-9088 branch October 4, 2026 19:34

Conversation

Copilot AI commented Oct 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

lpcox commented Oct 4, 2026

Uh oh!

Copilot AI commented Oct 4, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

lpcox commented Oct 4, 2026

Uh oh!

Copilot AI commented Oct 4, 2026

Uh oh!

github-actions Bot commented Oct 4, 2026

Uh oh!

github-actions Bot commented Oct 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Coverage Check Passed

Overall Coverage

Uh oh!

lpcox commented Oct 4, 2026

Uh oh!

Copilot AI commented Oct 4, 2026

Uh oh!

github-actions Bot commented Oct 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 4, 2026

Uh oh!

github-actions Bot commented Oct 4, 2026

Smoke Claude Results

Uh oh!

github-actions Bot commented Oct 4, 2026

Uh oh!

github-actions Bot commented Oct 4, 2026

Smoke Test: Copilot BYOK (Direct) Mode ✅

Uh oh!

github-actions Bot commented Oct 4, 2026

Uh oh!

github-actions Bot commented Oct 4, 2026

Smoke Test: Cloud Hypervisor + Copilot

Uh oh!

github-actions Bot commented Oct 4, 2026

Uh oh!

github-actions Bot commented Oct 4, 2026

Chroot Version Comparison

Uh oh!

github-actions Bot commented Oct 4, 2026

🏗️ Build Test Suite Results

Copilot AI commented Oct 3, 2026 •

edited

Loading

github-actions Bot commented Oct 4, 2026 •

edited

Loading

github-actions Bot commented Oct 4, 2026 •

edited

Loading

github-actions Bot commented Oct 4, 2026 •

edited

Loading

github-actions Bot commented Oct 4, 2026 •

edited

Loading

github-actions Bot commented Oct 4, 2026 •

edited

Loading

github-actions Bot commented Oct 4, 2026 •

edited

Loading

github-actions Bot commented Oct 4, 2026 •

edited

Loading

github-actions Bot commented Oct 4, 2026 •

edited

Loading

github-actions Bot commented Oct 4, 2026 •

edited

Loading

github-actions Bot commented Oct 4, 2026 •

edited

Loading

github-actions Bot commented Oct 4, 2026 •

edited

Loading