Support runtime secret-backed OpenAI endpoint override in AWF api-proxy (#6656)

* Initial plan

* feat: support secret-backed OpenAI endpoint override

* fix: address review feedback for secret-backed OpenAI endpoint override

Three security issues identified in code review are fixed:

1. Sensitive hostname not leaked in logs/audit (Issue 1):
   - Add sensitiveAllowedDomains to NetworkOptions and propagate through config
   - resolveApiTargetsToAllowedDomains routes secret-derived entries to
     sensitiveAllowedDomains instead of allowedDomains when the array is provided
   - Squid config generation combines both arrays so egress still works
   - sensitiveAllowedDomains added to SENSITIVE_CONFIG_KEYS so it is
     excluded from the debug log and awf-resolved-config.json audit artifact

2. OPENAI_ENDPOINT_OVERRIDE excluded from agent environment (Issue 2):
   - Added to excluded-vars.ts when enableApiProxy is true so the sidecar
     endpoint URL never reaches the untrusted agent container

3. Allowlist resolution parity with sidecar routing (Issue 3):
   - resolveApiTargetsToAllowedDomains accepts new openaiEndpointOverride param
   - preflight.ts resolves OPENAI_ENDPOINT_OVERRIDE from all config sources
     (additionalEnv > envFile > process.env) matching getConfigEnvValue semantics
   - Ensures that --env / --env-file supplied overrides reach the Squid ACL

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>

Author: Copilot

docs/api-proxy-sidecar.md

@@ -318,7 +318,7 @@ If the key is present only in `secrets.*` but not exported into the step's `env:
 
 | Flag | Default | Description |
 |------|---------|-------------|
-| `--openai-api-target <host>` | `api.openai.com` | Custom upstream for OpenAI API requests (e.g. Azure OpenAI or an internal LLM router). Can also be set via `OPENAI_API_TARGET` env var. |
+| `--openai-api-target <host>` | `api.openai.com` | Custom upstream for OpenAI API requests (e.g. Azure OpenAI or an internal LLM router). Can also be set via `OPENAI_API_TARGET` env var (or `OPENAI_ENDPOINT_OVERRIDE` for runtime secret-backed endpoint injection). |
 | `--anthropic-api-target <host>` | `api.anthropic.com` | Custom upstream for Anthropic API requests (e.g. an internal Claude router). Can also be set via `ANTHROPIC_API_TARGET` env var. |
 | `--copilot-api-target <host>` | auto-derived | Custom upstream for GitHub Copilot API requests (useful for GHES). Can also be set via `COPILOT_API_TARGET` env var. |
 | `--vertex-api-target <host>` | `aiplatform.googleapis.com` | Custom upstream for Vertex API requests. Can also be set via `VERTEX_API_TARGET` env var. |

src/api-proxy-config-domains.test.ts

@@ -47,6 +47,60 @@ describe('resolveApiTargetsToAllowedDomains', () => {
     expect(domains).toContain('https://env.openai.com');
   });
 
+  it('should read OPENAI_ENDPOINT_OVERRIDE from env when OPENAI_API_TARGET is not set (backward compat: no sensitiveAllowedDomains)', () => {
+    const domains: string[] = [];
+    const env = { OPENAI_ENDPOINT_OVERRIDE: 'https://secret.openai.internal/path' };
+    resolveApiTargetsToAllowedDomains({}, domains, env);
+    // Backward compat: when sensitiveAllowedDomains is not supplied, falls back to allowedDomains
+    expect(domains).toContain('https://secret.openai.internal');
+  });
+
+  it('should route OPENAI_ENDPOINT_OVERRIDE host to sensitiveAllowedDomains when the array is provided', () => {
+    const domains: string[] = [];
+    const sensitive: string[] = [];
+    const env = { OPENAI_ENDPOINT_OVERRIDE: 'https://secret.openai.internal/path' };
+    resolveApiTargetsToAllowedDomains({}, domains, env, () => {}, sensitive);
+    expect(domains).not.toContain('https://secret.openai.internal');
+    expect(sensitive).toContain('https://secret.openai.internal');
+  });
+
+  it('should use pre-resolved openaiEndpointOverride param over env fallback', () => {
+    const domains: string[] = [];
+    const sensitive: string[] = [];
+    const env = { OPENAI_ENDPOINT_OVERRIDE: 'https://env-fallback.openai.internal' };
+    resolveApiTargetsToAllowedDomains({}, domains, env, () => {}, sensitive, 'https://additional-env.openai.internal');
+    expect(sensitive).toContain('https://additional-env.openai.internal');
+    expect(sensitive).not.toContain('https://env-fallback.openai.internal');
+  });
+
+  it('should use openaiEndpointOverride param even when env has no OPENAI_ENDPOINT_OVERRIDE', () => {
+    const domains: string[] = [];
+    const sensitive: string[] = [];
+    resolveApiTargetsToAllowedDomains({}, domains, {}, () => {}, sensitive, 'https://additionalenv-only.openai.internal');
+    expect(sensitive).toContain('https://additionalenv-only.openai.internal');
+    expect(domains).not.toContain('https://additionalenv-only.openai.internal');
+  });
+
+  it('should not include OPENAI_ENDPOINT_OVERRIDE host value in debug logs', () => {
+    const domains: string[] = [];
+    const debugMessages: string[] = [];
+    const env = { OPENAI_ENDPOINT_OVERRIDE: 'https://secret.openai.internal/path' };
+    resolveApiTargetsToAllowedDomains({}, domains, env, (msg) => debugMessages.push(msg));
+    expect(debugMessages.some(msg => msg.includes('secret.openai.internal'))).toBe(false);
+    expect(debugMessages).toContain('Auto-added OpenAI endpoint override host to allowed domains');
+  });
+
+  it('should prefer OPENAI_API_TARGET over OPENAI_ENDPOINT_OVERRIDE', () => {
+    const domains: string[] = [];
+    const env = {
+      OPENAI_API_TARGET: 'env.openai.com',
+      OPENAI_ENDPOINT_OVERRIDE: 'secret.openai.internal',
+    };
+    resolveApiTargetsToAllowedDomains({}, domains, env);
+    expect(domains).toContain('https://env.openai.com');
+    expect(domains).not.toContain('https://secret.openai.internal');
+  });
+
   it('should read ANTHROPIC_API_TARGET from env when flag not set', () => {
     const domains: string[] = [];
     const env = { ANTHROPIC_API_TARGET: 'env.anthropic.com' };

src/api-proxy-config-domains.ts

@@ -105,6 +105,13 @@ function extractGhesDomainsFromEngineApiTarget(
  * @param allowedDomains - The current list of allowed domains (mutated in place)
  * @param env - Environment variables (defaults to process.env)
  * @param debug - Optional debug logging function
+ * @param sensitiveAllowedDomains - Optional separate array for sensitive (secret-derived) domains.
+ *   When provided, domains derived from `OPENAI_ENDPOINT_OVERRIDE` are pushed here instead of
+ *   into `allowedDomains` so they are never logged or included in audit artifacts.
+ * @param openaiEndpointOverride - Optional pre-resolved value of OPENAI_ENDPOINT_OVERRIDE,
+ *   already read from all config sources (additionalEnv, envFile, process.env). When provided,
+ *   it takes precedence over `env['OPENAI_ENDPOINT_OVERRIDE']` so that overrides supplied via
+ *   `--env` or `--env-file` are honoured by allowlist expansion as well as sidecar routing.
  * @returns The updated allowedDomains array (same reference, mutated)
  */
 export function resolveApiTargetsToAllowedDomains(
@@ -117,38 +124,47 @@ export function resolveApiTargetsToAllowedDomains(
   },
   allowedDomains: string[],
   env: Record<string, string | undefined> = process.env,
-  debug: (msg: string) => void = () => {}
+  debug: (msg: string) => void = () => {},
+  sensitiveAllowedDomains?: string[],
+  openaiEndpointOverride?: string,
 ): string[] {
-  const apiTargets: string[] = [];
+  const apiTargets: Array<{ value: string; sensitive?: boolean }> = [];
 
   if (options.copilotApiTarget) {
-    apiTargets.push(options.copilotApiTarget);
+    apiTargets.push({ value: options.copilotApiTarget });
   } else if (env['COPILOT_API_TARGET']) {
-    apiTargets.push(env['COPILOT_API_TARGET']);
+    apiTargets.push({ value: env['COPILOT_API_TARGET'] });
   }
 
   if (options.openaiApiTarget) {
-    apiTargets.push(options.openaiApiTarget);
+    apiTargets.push({ value: options.openaiApiTarget });
   } else if (env['OPENAI_API_TARGET']) {
-    apiTargets.push(env['OPENAI_API_TARGET']);
+    apiTargets.push({ value: env['OPENAI_API_TARGET'] });
+  } else {
+    // Prefer the pre-resolved override (from additionalEnv / envFile / process.env),
+    // falling back to the raw env lookup for backward-compat callers that don't pass it.
+    const endpointOverride = openaiEndpointOverride ?? env['OPENAI_ENDPOINT_OVERRIDE'];
+    if (endpointOverride) {
+      apiTargets.push({ value: endpointOverride, sensitive: true });
+    }
   }
 
   if (options.anthropicApiTarget) {
-    apiTargets.push(options.anthropicApiTarget);
+    apiTargets.push({ value: options.anthropicApiTarget });
   } else if (env['ANTHROPIC_API_TARGET']) {
-    apiTargets.push(env['ANTHROPIC_API_TARGET']);
+    apiTargets.push({ value: env['ANTHROPIC_API_TARGET'] });
   }
 
   if (options.geminiApiTarget) {
-    apiTargets.push(options.geminiApiTarget);
+    apiTargets.push({ value: options.geminiApiTarget });
   } else if (env['GEMINI_API_TARGET']) {
-    apiTargets.push(env['GEMINI_API_TARGET']);
+    apiTargets.push({ value: env['GEMINI_API_TARGET'] });
   }
 
   if (options.vertexApiTarget) {
-    apiTargets.push(options.vertexApiTarget);
+    apiTargets.push({ value: options.vertexApiTarget });
   } else if (env['VERTEX_API_TARGET']) {
-    apiTargets.push(env['VERTEX_API_TARGET']);
+    apiTargets.push({ value: env['VERTEX_API_TARGET'] });
   }
 
   // Auto-populate GHEC domains when GITHUB_SERVER_URL points to a *.ghe.com tenant
@@ -176,10 +192,12 @@ export function resolveApiTargetsToAllowedDomains(
   // Merge API target values into the allowedDomains list so that later checks/logs about
   // "no allowed domains" see the final, expanded allowlist.
   // API targets may be provided as full URLs; only the hostname is relevant to Squid allowlisting.
+  type NormalizedApiTarget = { hostname: string; scheme: 'http' | 'https'; sensitive?: boolean };
   const normalizedApiTargets = apiTargets
-    .map((t) => (typeof t === 'string' ? t.trim() : ''))
-    .filter((t) => t.length > 0)
-    .map((raw) => {
+    .map(({ value, sensitive }) => ({ value: (typeof value === 'string' ? value.trim() : ''), sensitive }))
+    .filter(({ value }) => value.length > 0)
+    .flatMap(({ value, sensitive }): NormalizedApiTarget[] => {
+      const raw = value;
       const hasScheme = /^[a-zA-Z][a-zA-Z\d+\-.]*:\/\//.test(raw);
       const candidate = hasScheme ? raw : `https://${raw}`;
 
@@ -189,22 +207,35 @@ export function resolveApiTargetsToAllowedDomains(
       } catch {
         // Let domain-validation surface a clear error later.
       }
-      if (!hostname) return null;
+      if (!hostname) return [];
 
       const scheme: 'http' | 'https' = /^http:\/\//i.test(raw) ? 'http' : 'https';
-      return { hostname, scheme } as const;
-    })
-    .filter((t): t is { hostname: string; scheme: 'http' | 'https' } => t !== null);
+      return [{ hostname, scheme, sensitive }];
+    });
 
   if (normalizedApiTargets.length > 0) {
-    for (const { hostname, scheme } of normalizedApiTargets) {
+    for (const { hostname, scheme, sensitive } of normalizedApiTargets) {
       const urlEntry = `${scheme}://${hostname}`;
-      if (!allowedDomains.includes(urlEntry)) {
-        allowedDomains.push(urlEntry);
-        debug(`Automatically added API target to allowlist: ${urlEntry}`);
+      // Route sensitive (secret-derived) entries to sensitiveAllowedDomains when the
+      // caller supplies that array so the value never appears in allowedDomains (which
+      // is logged and written to the audit artifact).  Fall back to allowedDomains for
+      // callers that don't supply the array (backward compatibility).
+      const targetList = (sensitive && sensitiveAllowedDomains) ? sensitiveAllowedDomains : allowedDomains;
+      if (!targetList.includes(urlEntry)) {
+        targetList.push(urlEntry);
+        if (!sensitive) {
+          debug(`Automatically added API target to allowlist: ${urlEntry}`);
+        }
       }
     }
-    debug(`Auto-added API target hostnames to allowed domains: ${normalizedApiTargets.map(t => t.hostname).join(', ')}`);
+
+    const nonSensitiveHosts = normalizedApiTargets.filter(t => !t.sensitive).map(t => t.hostname);
+    if (nonSensitiveHosts.length > 0) {
+      debug(`Auto-added API target hostnames to allowed domains: ${nonSensitiveHosts.join(', ')}`);
+    }
+    if (normalizedApiTargets.some(t => t.sensitive)) {
+      debug('Auto-added OpenAI endpoint override host to allowed domains');
+    }
   }
 
   return allowedDomains;

src/commands/build-config.ts

@@ -44,6 +44,7 @@ interface BuildConfigInputs {
   agentCommand: string;
   logLevel: LogLevel;
   allowedDomains: string[];
+  sensitiveAllowedDomains?: string[];
   blockedDomains: string[];
   localhostDetected: boolean;
   additionalEnv: Record<string, string>;
@@ -81,6 +82,7 @@ export function buildConfig(inputs: BuildConfigInputs): WrapperConfig {
     agentCommand,
     logLevel,
     allowedDomains,
+    sensitiveAllowedDomains = [],
     blockedDomains,
     localhostDetected,
     additionalEnv,
@@ -116,6 +118,7 @@ export function buildConfig(inputs: BuildConfigInputs): WrapperConfig {
 
   return {
     allowedDomains,
+    sensitiveAllowedDomains: sensitiveAllowedDomains.length > 0 ? sensitiveAllowedDomains : undefined,
     blockedDomains: blockedDomains.length > 0 ? blockedDomains : undefined,
     agentCommand,
     logLevel,

src/commands/main-action.ts

@@ -48,6 +48,8 @@ const SENSITIVE_CONFIG_KEYS = new Set([
   'geminiApiKey',
   'googleApiKey',
   'githubToken',
+  // Secret-derived allowlist entries must not appear in logs or the audit artifact.
+  'sensitiveAllowedDomains',
 ]);
 
 function redactConfigForLogging(config: WrapperConfig): Record<string, unknown> {

src/commands/preflight.test.ts

@@ -18,6 +18,9 @@ jest.mock('../domain-validation');
 jest.mock('../option-parsers');
 jest.mock('../copilot-api-resolver');
 jest.mock('../api-proxy-config');
+jest.mock('../github-env', () => ({
+  readEnvFile: jest.fn().mockReturnValue({}),
+}));
 
 import { logger } from '../logger';
 import * as configFile from '../config-file';
@@ -29,6 +32,7 @@ import * as domainValidation from '../domain-validation';
 import * as optionParsers from '../option-parsers';
 import * as copilotResolver from '../copilot-api-resolver';
 import * as apiProxyConfig from '../api-proxy-config';
+import * as githubEnv from '../github-env';
 
 const mockedLogger = logger as jest.Mocked<typeof logger>;
 const mockedConfigFile = configFile as jest.Mocked<typeof configFile>;
@@ -40,6 +44,7 @@ const mockedDomainValidation = domainValidation as jest.Mocked<typeof domainVali
 const mockedOptionParsers = optionParsers as jest.Mocked<typeof optionParsers>;
 const mockedCopilotResolver = copilotResolver as jest.Mocked<typeof copilotResolver>;
 const mockedApiProxyConfig = apiProxyConfig as jest.Mocked<typeof apiProxyConfig>;
+const mockedGithubEnv = githubEnv as jest.Mocked<typeof githubEnv>;
 
 describe('applyConfigFilePrecedence', () => {
   let processExitSpy: jest.SpyInstance;
@@ -137,6 +142,7 @@ describe('resolveAllowedDomains', () => {
       copilotApiBasePath: undefined,
     });
     mockedApiProxyConfig.resolveApiTargetsToAllowedDomains.mockReturnValue([]);
+    mockedGithubEnv.readEnvFile.mockReturnValue({});
   });
 
   afterEach(() => {
@@ -370,6 +376,51 @@ describe('resolveAllowedDomains', () => {
     });
     expect(result.allowedDomains).toContain('awmg-cli-proxy');
   });
+
+  it('always returns sensitiveAllowedDomains in the result', () => {
+    const result = resolveAllowedDomains({});
+    expect(result).toHaveProperty('sensitiveAllowedDomains');
+    expect(Array.isArray(result.sensitiveAllowedDomains)).toBe(true);
+  });
+
+  it('passes OPENAI_ENDPOINT_OVERRIDE from additionalEnv to resolveApiTargetsToAllowedDomains', () => {
+    resolveAllowedDomains({
+      additionalEnv: { OPENAI_ENDPOINT_OVERRIDE: 'https://additional-env.example.com' },
+    });
+    expect(mockedApiProxyConfig.resolveApiTargetsToAllowedDomains).toHaveBeenCalledWith(
+      expect.any(Object),
+      expect.any(Array),
+      expect.any(Object),
+      expect.any(Function),
+      expect.any(Array),
+      'https://additional-env.example.com',
+    );
+  });
+
+  it('passes OPENAI_ENDPOINT_OVERRIDE from envFile to resolveApiTargetsToAllowedDomains', () => {
+    mockedGithubEnv.readEnvFile.mockReturnValue({ OPENAI_ENDPOINT_OVERRIDE: 'https://envfile.example.com' });
+    resolveAllowedDomains({ envFile: '/path/to/.env' });
+    expect(mockedApiProxyConfig.resolveApiTargetsToAllowedDomains).toHaveBeenCalledWith(
+      expect.any(Object),
+      expect.any(Array),
+      expect.any(Object),
+      expect.any(Function),
+      expect.any(Array),
+      'https://envfile.example.com',
+    );
+  });
+
+  it('passes undefined openaiEndpointOverride when not set in any source', () => {
+    resolveAllowedDomains({});
+    expect(mockedApiProxyConfig.resolveApiTargetsToAllowedDomains).toHaveBeenCalledWith(
+      expect.any(Object),
+      expect.any(Array),
+      expect.any(Object),
+      expect.any(Function),
+      expect.any(Array),
+      undefined,
+    );
+  });
 });
 
 describe('parseDomainOptions', () => {

src/commands/preflight.ts

@@ -9,6 +9,7 @@ import { processLocalhostKeyword } from '../option-parsers';
 import { resolveCopilotApiRouting } from '../copilot-api-resolver';
 import { resolveApiTargetsToAllowedDomains } from '../api-proxy-config';
 import { resolveTopologyPeerHosts } from '../topology-peers';
+import { readEnvFile } from '../github-env';
 
 /**
  * Resolves the Commander option-value source for a given option name.
@@ -21,6 +22,7 @@ type OptionSourceResolver = (optionName: string) => string | undefined;
  */
 interface AllowedDomainsResult {
   allowedDomains: string[];
+  sensitiveAllowedDomains: string[];
   localhostResult: ReturnType<typeof processLocalhostKeyword>;
   resolvedCopilotApiTarget: string | undefined;
   resolvedCopilotApiBasePath: string | undefined;
@@ -162,9 +164,21 @@ export function resolveAllowedDomains(options: Record<string, unknown>): Allowed
     process.env
   );
 
-  // Automatically add API target values to allowlist when specified
-  // This ensures that when engine.api-target is set in GitHub Agentic Workflows,
-  // the target domain is automatically accessible through the firewall
+  // Resolve OPENAI_ENDPOINT_OVERRIDE from all config sources so that values
+  // supplied via --env or --env-file reach the allowlist (not just process.env).
+  // Priority matches getConfigEnvValue: additionalEnv > envFile > process.env.
+  const additionalEnv = options.additionalEnv as Record<string, string> | undefined;
+  const envFilePath = options.envFile as string | undefined;
+  const openaiEndpointOverride: string | undefined = (
+    additionalEnv?.['OPENAI_ENDPOINT_OVERRIDE']
+    ?? (envFilePath ? readEnvFile(envFilePath)['OPENAI_ENDPOINT_OVERRIDE'] : undefined)
+    ?? process.env['OPENAI_ENDPOINT_OVERRIDE']
+  ) || undefined;
+
+  // Automatically add API target values to allowlist when specified.
+  // Secret-derived entries (OPENAI_ENDPOINT_OVERRIDE) go into sensitiveAllowedDomains
+  // so they are never logged or included in the audit config artifact.
+  const sensitiveAllowedDomains: string[] = [];
   resolveApiTargetsToAllowedDomains(
     {
       copilotApiTarget: resolvedCopilotApiTarget,
@@ -174,7 +188,9 @@ export function resolveAllowedDomains(options: Record<string, unknown>): Allowed
     },
     allowedDomains,
     process.env,
-    logger.debug.bind(logger)
+    logger.debug.bind(logger),
+    sensitiveAllowedDomains,
+    openaiEndpointOverride,
   );
 
   // In network-isolation (topology) mode, automatically add trusted topology
@@ -203,7 +219,7 @@ export function resolveAllowedDomains(options: Record<string, unknown>): Allowed
 
   validateAllowedDomains(allowedDomains);
 
-  return { allowedDomains, localhostResult, resolvedCopilotApiTarget, resolvedCopilotApiBasePath };
+  return { allowedDomains, sensitiveAllowedDomains, localhostResult, resolvedCopilotApiTarget, resolvedCopilotApiBasePath };
 }
 
 /**