[aw-failures] [P0] Crush harness hardcodes unresolvable "api-proxy" host for chat completions — regression from PR #52576, break [Content truncated due to length]

[github-actions]

Problem

Fix the Crush harness's chat-completion request target — it resolves the reflect probe's baseUrl to host.docker.internal:10002 correctly, then immediately fires the real /chat/completions POST at the bare hostname api-proxy:10002 instead, which the sandbox's DNS can't resolve. The run dies before a single turn completes.

Affected workflow and run

• Workflow: arXiv Paper Researcher: GitHub Agentic Workflows (.github/workflows/daily-arxiv-researcher.lock.yml)
• Failed run: §31874781096 (2026-08-15 08:37 UTC), job agent, step Execute Crush CLI
• Comparator (last success): §31372099754 (2026-08-10)

Evidence

• agent-stdio.log: [crush-harness] awf-reflect: provider=github mapped to endpoint provider=copilot baseUrl=(host.docker.internal/redacted) immediately followed by the fatal error: Agent processing failed: failed to start agent processing stream: retry error: Post "(apiproxy/redacted) dial tcp: lookup api-proxy on 172.17.0.0:53: no such host.`
• This same workflow failed the prior 4 consecutive scheduled runs (08-11 → 08-14) with a different signature — [crush-harness] spawnSync crush ENOENT — confirmed directly in each run's job log, tracked as [aw-failures] [P0] Crush CLI ENOENT in sandboxed exec — Daily Code Metrics failing 2 days running #52571 and closed via PR Stage behavior-defined engine CLIs into the docker-sbx visible path #52576 (merged 2026-08-15T05:21:29Z).
• This run (08:37 UTC) is the first scheduled run of this workflow after PR Stage behavior-defined engine CLIs into the docker-sbx visible path #52576 landed (~3h earlier). The failure mode flipped from ENOENT to a DNS lookup error in the exact same crush-harness → api-proxy code path — strong evidence PR Stage behavior-defined engine CLIs into the docker-sbx visible path #52576 fixed the binary-visibility bug but introduced this new one.
• audit-diff against the last successful run (08-10) shows zero firewall/domain blocks — this is not a network-policy rejection, it's a plain unresolvable hostname.

Probable root cause

PR #52576 staged the Crush CLI binary into the sandbox's visible path to fix ENOENT, and in the process likely altered the sandbox's hosts/network configuration. The reflect probe's own request to api-proxy:10000/reflect still succeeds (it runs in a shell that has HOSTALIASES pointing api-proxy at localhost), but the crush binary's own outbound /chat/completions request runs in a different process context where that alias isn't applied, so it falls through to real DNS and fails — instead of reusing the host.docker.internal baseUrl the reflect step already resolved.

Proposed remediation

1. Make the crush binary's actual chat-completion request use the same resolved baseUrl the reflect probe already computed (host.docker.internal:10002), not a separately hardcoded/re-derived api-proxy hostname.
2. If api-proxy is meant to resolve sandbox-wide, verify HOSTALIASES (or equivalent) is exported into the process environment the crush child actually runs in, not just the one-off reflect shell.
3. Add regression coverage: run a Crush-engine workflow end-to-end through the sandboxed exec path and assert the chat-completion request succeeds, not just that the binary is present and executable.

Success criteria

• Next 3 scheduled runs of daily-arxiv-researcher (and any other Crush-engine workflow) complete without a dial tcp: lookup api-proxy ... no such host error.
• Add a test asserting the Crush harness's actual model-request host matches its resolved reflect baseUrl.

Parent: #52570
Related: #52571 (closed — ENOENT bug fixed by PR #52576; this is a regression from that same fix)
Related to #52570

Generated by 🔍 [aw] Failure Investigator (6h) · agent · 222 AIC · ⌖ 6.48 AIC · ⊞ 5.6K · ◷

• expires on Aug 22, 2026, 5:14 AM UTC-08:00

[github-actions]

🍪 Issue Monster selected this for Copilot

I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

🍪 Om nom nom by Issue Monster · gpt54 · 2.92 AIC · ⌖ 9.55 AIC · ⊞ 13.2K · ◷