refactor: remove --allow-full-filesystem-access flag by Mossaka · Pull Request #1056 · github/gh-aw-firewall

Mossaka · 2026-02-25T20:48:41Z

Summary

Remove the --allow-full-filesystem-access CLI flag that disabled selective mounting security
Make credential hiding unconditional (remove if/else guards around selective mounting)
Delete 2 unit tests and 2 integration tests that exercised the removed flag
Clean up all documentation references (usage guide, selective-mounting docs, CLI reference)

Motivation

The flag was an escape hatch that mounted the entire host filesystem with read-write access (/:/host:rw), defeating AWF's credential exfiltration protection. It is no longer needed because:

gh-aw never passes this flag (not in awf_helpers.go)
No CI workflows or smoke tests use it (only 2 dedicated integration tests)
It was already hidden from --help in PR feat: group --help flags by category, hide dev-only options #1035
The --mount flag covers the use case of mounting specific directories
It contradicts the security model (defeats credential hiding)

Files changed (12)

File	Change
`src/cli.ts`	Remove option definition and config property
`src/types.ts`	Remove `allowFullFilesystemAccess` field from `WrapperConfig`
`src/docker-manager.ts`	Remove if/else branch, make credential hiding unconditional
`src/docker-manager.test.ts`	Delete 2 `allowFullFilesystemAccess` test cases
`tests/fixtures/awf-runner.ts`	Remove from `AwfOptions` interface and both `if` blocks
`tests/integration/credential-hiding.test.ts`	Delete Test 10 and Test 11
`docs/usage.md`	Remove flag from CLI options
`docs/selective-mounting.md`	Remove "Full Filesystem Access" section and references
`docs-site/.../cli-reference.md`	Remove table row and detail section
`docs/test-analysis/*.md`	Clean up references

Test plan

npx tsc --noEmit — compiles with no errors
npm test — all 798 unit tests pass
node dist/cli.js --help — flag absent from output
node dist/cli.js --allow-full-filesystem-access -- echo test — errors as unknown option
CI integration tests pass

🤖 Generated with Claude Code

github-actions · 2026-02-25T20:49:35Z

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	82.39%	82.48%	📈 +0.09%
Statements	82.32%	82.41%	📈 +0.09%
Functions	82.74%	82.74%	➡️ +0.00%
Branches	74.55%	74.55%	➡️ +0.00%

📁 Per-file Coverage Changes (1 files)

File	Lines (Before → After)	Statements (Before → After)
`src/docker-manager.ts`	83.6% → 83.9% (+0.35%)	82.8% → 83.2% (+0.33%)

Coverage comparison generated by scripts/ci/compare-coverage.ts

github-actions · 2026-02-25T20:52:19Z

🧪 Build Test: Bun Results

Project	Install	Tests	Status
elysia	✅	1/1	✅ PASS
hono	✅	1/1	✅ PASS

Overall: ✅ PASS

Bun version: 1.3.9
All tests passed across both projects

Generated by Build Test Bun for issue #1056

github-actions · 2026-02-25T20:52:29Z

🦕 Deno Build Test Results

Project	Tests	Status
oak	1/1	✅ PASS
std	1/1	✅ PASS

Overall: ✅ PASS

Test output details

oak:

running 1 test from ./test.ts
oak test ... ok (0ms)
ok | 1 passed | 0 failed (2ms)
```

**std:**
```
running 1 test from ./test.ts
std test ... ok (0ms)
ok | 1 passed | 0 failed (2ms)

Generated by Build Test Deno for issue #1056

github-actions · 2026-02-25T20:52:56Z

Smoke test results:
Merged PRs: docs: add integration test coverage guide with gap analysis; feat: group --help flags by category, hide dev-only options
GitHub MCP review ✅
safeinputs-gh pr list ✅
Playwright title ✅
Tavily search ❌ (tool unavailable)
File write + cat ✅
Discussion comment ✅
Build ✅
Overall: FAIL

🔮 The oracle has spoken through Smoke Codex for issue #1056

github-actions · 2026-02-25T20:52:58Z

Go Build Test Results

Project	Download	Tests	Status
color	✅	PASS	✅ PASS
env	✅	PASS	✅ PASS
uuid	✅	PASS	✅ PASS

Overall: ✅ PASS

Generated by Build Test Go for issue #1056

github-actions · 2026-02-25T20:53:00Z

C++ Build Test Results

Project	CMake	Build	Status
fmt	✅	✅	PASS
json	✅	✅	PASS

Overall: PASS

Generated by Build Test C++ for issue #1056

github-actions · 2026-02-25T20:53:01Z

🦀 Rust Build Test Results

Project	Build	Tests	Status
fd	✅	1/1	PASS
zoxide	✅	1/1	PASS

Overall: ✅ PASS

Generated by Build Test Rust for issue #1056

Copilot

Pull request overview

This PR removes the --allow-full-filesystem-access CLI flag that allowed disabling AWF's selective mounting security feature. The flag was an escape hatch that mounted the entire host filesystem with read-write access (/:/host:rw), defeating credential exfiltration protection. With this removal, credential hiding via selective mounting becomes the only supported mode, strengthening the security posture.

Changes:

Removed the --allow-full-filesystem-access CLI option and type definitions
Made credential hiding unconditional by removing if/else branches in docker-manager
Deleted 4 tests (2 unit, 2 integration) that exercised the removed flag
Cleaned up documentation references across usage guides, selective-mounting docs, CLI reference, and test analysis docs
Added 92 lines of new block-domains integration tests and test fixture support for envAll/cliEnv (not mentioned in PR description)

Reviewed changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
src/cli.ts	Removed `--allow-full-filesystem-access` option definition and removed `allowFullFilesystemAccess` from config object
src/types.ts	Removed `allowFullFilesystemAccess` field and its extensive documentation block from `WrapperConfig` interface
src/docker-manager.ts	Removed if/else branching - credential hiding via /dev/null mounts is now unconditional; updated comments
src/docker-manager.test.ts	Deleted 2 duplicate unit tests that verified blanket mount behavior with the flag
tests/fixtures/awf-runner.ts	Removed `allowFullFilesystemAccess` from interface; added `blockDomains`, `envAll`, and `cliEnv` support
tests/integration/credential-hiding.test.ts	Deleted Test 10 (security warnings) and Test 11 (Docker config not hidden) that tested the flag
tests/integration/blocked-domains.test.ts	Added 92 lines of new block-domains integration tests (6 test cases)
docs/usage.md	Removed 6 lines describing the flag and its security warnings
docs/selective-mounting.md	Removed "Full Filesystem Access" section (14 lines) and updated comments
docs-site/.../cli-reference.md	Removed CLI table row and 26-line detail section for the flag
docs/test-analysis/test-infra.md	Removed `allowFullFilesystemAccess` from interface documentation
docs/test-analysis/protocol-security.md	Removed 3 references to full filesystem access tests
docs/test-analysis/chroot.md	Removed 2 gap notes about missing flag tests

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-02-25T20:53:02Z

tests/integration/blocked-domains.test.ts

+describe('Block Domains Deny-List (--block-domains)', () => {
+  let runner: AwfRunner;
+
+  beforeAll(async () => {
+    await cleanup(false);
+    runner = createRunner();
+  });
+
+  afterAll(async () => {
+    await cleanup(false);
+  });
+
+  test('should block specific subdomain while allowing parent domain', async () => {
+    const result = await runner.runWithSudo(
+      'curl -f --max-time 10 https://api.github.com/zen',
+      {
+        allowDomains: ['github.com'],
+        blockDomains: ['api.github.com'],
+        logLevel: 'debug',
+        timeout: 60000,
+      }
+    );
+    expect(result).toFail();
+  }, 120000);
+
+  test('should still allow non-blocked subdomains when parent is allowed', async () => {
+    const result = await runner.runWithSudo(
+      'curl -f --max-time 10 https://github.com',
+      {
+        allowDomains: ['github.com'],
+        blockDomains: ['api.github.com'],
+        logLevel: 'debug',
+        timeout: 60000,
+      }
+    );
+    expect(result).toSucceed();
+  }, 120000);
+
+  test('should block domain that is also in the allow list (block takes precedence)', async () => {
+    const result = await runner.runWithSudo(
+      'curl -f --max-time 5 https://example.com',
+      {
+        allowDomains: ['example.com'],
+        blockDomains: ['example.com'],
+        logLevel: 'debug',
+        timeout: 60000,
+      }
+    );
+    expect(result).toFail();
+  }, 120000);
+
+  test('should block wildcard pattern while allowing parent domain', async () => {
+    const result = await runner.runWithSudo(
+      'curl -f --max-time 10 https://api.github.com/zen',
+      {
+        allowDomains: ['github.com'],
+        blockDomains: ['*.github.com'],
+        logLevel: 'debug',
+        timeout: 60000,
+      }
+    );
+    expect(result).toFail();
+  }, 120000);
+
+  test('should handle multiple blocked domains', async () => {
+    const result = await runner.runWithSudo(
+      'bash -c "curl -f --max-time 10 https://api.github.com/zen 2>&1; echo exit=$?"',
+      {
+        allowDomains: ['github.com'],
+        blockDomains: ['api.github.com', 'raw.githubusercontent.com'],
+        logLevel: 'debug',
+        timeout: 60000,
+      }
+    );
+    expect(result.stdout).toContain('exit=');
+    expect(result.stdout).not.toContain('exit=0');
+  }, 120000);
+
+  test('should show blocked domains in debug output', async () => {
+    const result = await runner.runWithSudo(
+      'echo "test"',
+      {
+        allowDomains: ['github.com'],
+        blockDomains: ['api.github.com'],
+        logLevel: 'debug',
+        timeout: 60000,
+      }
+    );
+    expect(result).toSucceed();
+    expect(result.stderr).toMatch(/[Bb]locked domains:/i);
+  }, 120000);
+});


The PR description does not mention adding these 92 lines of new block-domains integration tests. This appears to be a separate feature enhancement bundled with the flag removal. Consider splitting this into a separate PR or updating the PR description to document this addition.

These tests add coverage for the existing --block-domains feature:

Blocking specific subdomains while allowing parent

Block precedence over allow

Wildcard patterns in block lists

Multiple blocked domains

Debug output verification

Copilot · 2026-02-25T20:53:03Z

tests/fixtures/awf-runner.ts

@@ -52,6 +54,11 @@ export class AwfRunner {
      args.push('--allow-domains', options.allowDomains.join(','));
    }

+    // Add block-domains
+    if (options.blockDomains && options.blockDomains.length > 0) {
+      args.push('--block-domains', options.blockDomains.join(','));
+    }
+
    // Add other flags
    if (options.keepContainers) {
      args.push('--keep-containers');
@@ -100,16 +107,23 @@ export class AwfRunner {
      args.push('--allow-host-ports', options.allowHostPorts);
    }

-    // Add allow-full-filesystem-access flag
-    if (options.allowFullFilesystemAccess) {
-      args.push('--allow-full-filesystem-access');
-    }
-
    // Add enable-api-proxy flag
    if (options.enableApiProxy) {
      args.push('--enable-api-proxy');
    }

+    // Add --env-all flag
+    if (options.envAll) {
+      args.push('--env-all');
+    }
+
+    // Add explicit -e KEY=VALUE flags
+    if (options.cliEnv) {
+      for (const [key, value] of Object.entries(options.cliEnv)) {
+        args.push('-e', `${key}=${value}`);
+      }
+    }


The PR description does not mention adding support for envAll and cliEnv fields to the AwfOptions interface and both run methods. These appear to be separate enhancements for environment variable handling in tests, bundled with the flag removal. Consider updating the PR description to document these additions or splitting them into a separate PR.

These additions enable tests to:

Pass --env-all flag via envAll boolean

Pass explicit -e KEY=VALUE flags via cliEnv object

github-actions · 2026-02-25T20:53:26Z

🤖 Smoke test results for Copilot engine — run 22415315431

✅ GitHub MCP — Last 2 merged PRs:

docs: add integration test coverage guide with gap analysis #1036 "docs: add integration test coverage guide with gap analysis"
feat: group --help flags by category, hide dev-only options #1035 "feat: group --help flags by category, hide dev-only options"

✅ Playwright — github.com title contains "GitHub"
✅ File write — /tmp/gh-aw/agent/smoke-test-copilot-22415315431.txt created and verified
✅ Bash — cat confirmed file contents

Overall: PASS | Author: @Mossaka | No assignees

📰 BREAKING: Report filed by Smoke Copilot for issue #1056

github-actions · 2026-02-25T20:53:29Z

.NET Build Test Results

Project	Restore	Build	Run	Status
hello-world	✅	✅	✅	PASS
json-parse	✅	✅	✅	PASS

Overall: PASS

Run output

hello-world:

Hello, World!
```

**json-parse:**
```
{
  "Name": "AWF Test",
  "Version": 1,
  "Success": true
}
Name: AWF Test, Success: True

Generated by Build Test .NET for issue #1056

github-actions · 2026-02-25T20:53:31Z

Smoke Test Results

✅ GitHub MCP: docs: add integration test coverage guide with gap analysis #1036 docs: add integration test coverage guide with gap analysis; feat: group --help flags by category, hide dev-only options #1035 feat: group --help flags by category, hide dev-only options
✅ Playwright: github.com title contains "GitHub"
✅ File Write: /tmp/gh-aw/agent/smoke-test-claude-22415315472.txt created
✅ Bash: File contents verified via cat

Overall: PASS

💥 [THE END] — Illustrated by Smoke Claude for issue #1056

github-actions · 2026-02-25T20:53:46Z

Java Build Test Results

Project	Compile	Tests	Status
gson	✅	1/1	PASS
caffeine	✅	1/1	PASS

Overall: PASS ✅

Both projects compiled and all tests passed successfully using Maven with proxy configuration.

Generated by Build Test Java for issue #1056

github-actions · 2026-02-25T20:53:48Z

🟢 Node.js Build Test Results

Project	Install	Tests	Status
clsx	✅	All passed	PASS
execa	✅	All passed	PASS
p-limit	✅	All passed	PASS

Overall: PASS ✅

Generated by Build Test Node.js for issue #1056

github-actions · 2026-02-25T20:54:23Z

Chroot Version Comparison Results

Runtime	Host Version	Chroot Version	Match?
Python	Python 3.12.12	Python 3.12.3	❌ NO
Node.js	v24.13.1	v20.20.0	❌ NO
Go	go1.22.12	go1.22.12	✅ YES

Overall: ❌ Not all versions match — Python minor version differs (3.12.12 vs 3.12.3) and Node.js major version differs (v24 vs v20).

Tested by Smoke Chroot for issue #1056

The flag was an escape hatch that disabled selective mounting security by adding a blanket /:/host:rw mount, exposing all credential files. It contradicts the security model and is no longer needed: - gh-aw never passes this flag (not in awf_helpers.go) - No CI workflows or smoke tests use it - It was already hidden from --help in PR #1035 - The --mount flag covers mounting specific directories Credential hiding is now unconditional — the if/else guards around selective mounting are removed, making the secure path the only path. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

github-actions · 2026-02-25T21:33:08Z

Smoke Test Results

✅ GitHub MCP: docs: add integration test coverage guide with gap analysis #1036 "docs: add integration test coverage guide with gap analysis", feat: group --help flags by category, hide dev-only options #1035 "feat: group --help flags by category, hide dev-only options"
✅ Playwright: github.com title contains "GitHub"
✅ File write: /tmp/gh-aw/agent/smoke-test-claude-22416738853.txt created
✅ Bash verify: file contents confirmed

Overall: PASS

💥 [THE END] — Illustrated by Smoke Claude for issue #1056

github-actions · 2026-02-25T21:33:26Z

C++ Build Test Results

Project	CMake	Build	Status
fmt	✅	✅	PASS
json	✅	✅	PASS

Overall: PASS

Generated by Build Test C++ for issue #1056

github-actions · 2026-02-25T21:33:29Z

🤖 Smoke Test Results

✅ GitHub MCP: docs: add integration test coverage guide with gap analysis #1036 "docs: add integration test coverage guide with gap analysis" by @Mossaka, feat: group --help flags by category, hide dev-only options #1035 "feat: group --help flags by category, hide dev-only options" by @Mossaka
✅ Playwright: GitHub page title verified ("GitHub · Change is constant. GitHub keeps you ahead. · GitHub")
✅ File write: /tmp/gh-aw/agent/smoke-test-copilot-22416738899.txt created and read back
✅ Bash: File contents verified

Overall: PASS | PR author: @Mossaka

📰 BREAKING: Report filed by Smoke Copilot for issue #1056

github-actions · 2026-02-25T21:33:31Z

🧪 Bun Build Test Results

Project	Install	Tests	Status
elysia	✅	1/1	PASS
hono	✅	1/1	PASS

Overall: ✅ PASS

Bun version: 1.3.9

Generated by Build Test Bun for issue #1056

github-actions · 2026-02-25T21:33:36Z

🦕 Deno Build Test Results

Project	Tests	Status
oak	1/1	✅ PASS
std	1/1	✅ PASS

Overall: ✅ PASS

Generated by Build Test Deno for issue #1056

github-actions · 2026-02-25T21:33:38Z

Rust Build Test Results

Project	Build	Tests	Status
fd	✅	1/1	PASS
zoxide	✅	1/1	PASS

Overall: ✅ PASS

Generated by Build Test Rust for issue #1056

github-actions · 2026-02-25T21:33:43Z

.NET Build Test Results

Project	Restore	Build	Run	Status
hello-world	✅	✅	✅	PASS
json-parse	✅	✅	✅	PASS

Overall: PASS

Run output

hello-world: Hello, World!

json-parse:

{
  "Name": "AWF Test",
  "Version": 1,
  "Success": true
}
Name: AWF Test, Success: True

Generated by Build Test .NET for issue #1056

github-actions · 2026-02-25T21:33:54Z

Go Build Test Results

Project	Download	Tests	Status
color	✅	PASS	✅ PASS
env	✅	PASS	✅ PASS
uuid	✅	PASS	✅ PASS

Overall: ✅ PASS

Generated by Build Test Go for issue #1056

github-actions · 2026-02-25T21:33:58Z

Node.js Build Test Results ✅

Project	Install	Tests	Status
clsx	✅	PASS	PASS
execa	✅	PASS	PASS
p-limit	✅	PASS	PASS

Overall: PASS

Generated by Build Test Node.js for issue #1056

github-actions · 2026-02-25T21:34:51Z

Chroot Version Comparison Results

Runtime	Host Version	Chroot Version	Match?
Python	Python 3.12.12	Python 3.12.3	❌ NO
Node.js	v24.13.1	v20.20.0	❌ NO
Go	go1.22.12	go1.22.12	✅ YES

Overall: ❌ Not all versions matched — Python and Node.js versions differ between host and chroot environment.

Tested by Smoke Chroot for issue #1056

github-actions · 2026-02-25T21:34:58Z

GitHub MCP merged PRs: ✅
docs: add integration test coverage guide with gap analysis
feat: group --help flags by category, hide dev-only options
safeinputs-gh PR list: ✅
Playwright GitHub title: ✅
Tavily search: ❌
File write: ✅
Cat verify: ✅
Discussion comment: ✅
Build: ✅ | Overall: FAIL

🔮 The oracle has spoken through Smoke Codex for issue #1056

github-actions · 2026-02-25T21:35:09Z

Java Build Test Results

Project	Compile	Tests	Status
gson	✅	1/1	PASS
caffeine	✅	1/1	PASS

Overall: ✅ PASS

All Java projects compiled and tested successfully against Maven Central via the AWF proxy.

Generated by Build Test Java for issue #1056

Copilot AI review requested due to automatic review settings February 25, 2026 20:48

Copilot started reviewing on behalf of Mossaka February 25, 2026 20:49 View session

github-actions bot added the build-test-bun label Feb 25, 2026

github-actions bot added the build-test-deno label Feb 25, 2026

github-actions bot added the build-test-go label Feb 25, 2026

github-actions bot added the build-test-cpp label Feb 25, 2026

github-actions bot added the build-test-rust label Feb 25, 2026

Copilot AI reviewed Feb 25, 2026

View reviewed changes

github-actions bot added the smoke-copilot label Feb 25, 2026

github-actions bot added the build-test-dotnet label Feb 25, 2026

github-actions bot added the smoke-claude label Feb 25, 2026

github-actions bot added build-test-java build-test-node labels Feb 25, 2026

github-actions bot mentioned this pull request Feb 25, 2026

[agentics] No-Op Runs #769

Open

Mossaka changed the title ~~Remove --allow-full-filesystem-access flag~~ refactor: remove --allow-full-filesystem-access flag Feb 25, 2026

Mossaka force-pushed the remove-allow-full-filesystem-access branch from c95d447 to 24e648e Compare February 25, 2026 21:29

Mossaka merged commit f7c60f5 into main Feb 25, 2026
89 checks passed

Mossaka deleted the remove-allow-full-filesystem-access branch February 25, 2026 22:49

Conversation

Mossaka commented Feb 25, 2026

Summary

Motivation

Files changed (12)

Test plan

Uh oh!

github-actions bot commented Feb 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Coverage Check Passed

Overall Coverage

Uh oh!

github-actions bot commented Feb 25, 2026

🧪 Build Test: Bun Results

Uh oh!

github-actions bot commented Feb 25, 2026

🦕 Deno Build Test Results

Uh oh!

github-actions bot commented Feb 25, 2026

Uh oh!

github-actions bot commented Feb 25, 2026

Go Build Test Results

Uh oh!

github-actions bot commented Feb 25, 2026

C++ Build Test Results

Uh oh!

github-actions bot commented Feb 25, 2026

🦀 Rust Build Test Results

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Feb 25, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 25, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Feb 25, 2026

Uh oh!

github-actions bot commented Feb 25, 2026

.NET Build Test Results

Uh oh!

github-actions bot commented Feb 25, 2026

Smoke Test Results

Uh oh!

github-actions bot commented Feb 25, 2026

Java Build Test Results

Uh oh!

github-actions bot commented Feb 25, 2026

🟢 Node.js Build Test Results

Uh oh!

github-actions bot commented Feb 25, 2026

Chroot Version Comparison Results

Uh oh!

github-actions bot commented Feb 25, 2026

Uh oh!

github-actions bot commented Feb 25, 2026

C++ Build Test Results

Uh oh!

github-actions bot commented Feb 25, 2026

🤖 Smoke Test Results

Uh oh!

github-actions bot commented Feb 25, 2026

🧪 Bun Build Test Results

Uh oh!

github-actions bot commented Feb 25, 2026

🦕 Deno Build Test Results

Uh oh!

github-actions bot commented Feb 25, 2026

Rust Build Test Results

Uh oh!

github-actions bot commented Feb 25, 2026

.NET Build Test Results

Uh oh!

github-actions bot commented Feb 25, 2026

Go Build Test Results

Uh oh!

github-actions bot commented Feb 25, 2026 •

edited

Loading