Fix Crush harness sending chat-completions requests to unresolvable api-proxy host

[Copilot]

The Crush harness correctly resolved its LLM endpoint baseUrl via the /reflect probe (rewriting api-proxy to host.docker.internal for sandboxed runs), but then immediately overwrote that value with a base URL re-derived directly from the raw models_url, skipping the rewrite. The crush binary's actual /chat/completions request was thus sent to the bare api-proxy hostname, which the sandbox's DNS cannot resolve, failing every run before the first turn completed.

Changes

• actions/setup/js/awf_reflect.cjs: added deriveBaseUrlFromModelsURL(), which derives a base URL from models_url (stripping the trailing /models path segment) while applying the same api-proxy → host.docker.internal HOSTALIASES bridge rewrite used elsewhere in this module. Exported alongside the existing reflect helpers.
• .github/workflows/shared/crush.md: harness-script now calls deriveBaseUrlFromModelsURL() instead of manually reconstructing the URL inline, so the rewrite can no longer be silently bypassed.
• actions/setup/js/awf_reflect.test.cjs: added unit tests for the new helper, including a regression case that reproduces the exact failure (models_url pointing at api-proxy with HOSTALIASES mapping it to localhost).
• Recompiled workflows importing shared/crush.md: daily-arxiv-researcher, daily-code-metrics, smoke-crush.

// Before: rewrite bypassed
const modelsURL = new URL(reflectedEndpoint.models_url);
const basePath = modelsURL.pathname.replace(/\/models\/?$/i, "");
baseUrl = `${modelsURL.origin}${basePath}`;

// After: reuses the same bridge rewrite as resolveProviderEndpointFromReflect
baseUrl = deriveBaseUrlFromModelsURL(reflectedEndpoint.models_url);

• Fixes [aw-failures] [P0] Crush harness hardcodes unresolvable "api-proxy" host for chat completions — regression from PR #52576, break [Content truncated due to length] #52894

[pelikhan]

@copilot apply to other definition based engine files

[pelikhan]

/smoke-crush

[github-actions]

🎯 Smoke Crush Crush delivered.

Warning

Threat Detection Engine Failure — The analysis engine could not complete. This is a tooling failure, not a security finding.

What happened

The threat detection results could not be parsed.

Review the workflow run logs for details.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• proxy.golang.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "proxy.golang.org"

See Network Configuration for more information.

⚡ Smoke Crush — Powered by Crush

[Copilot]

Pull request overview

Fixes Crush endpoint resolution so chat-completions requests use the sandbox-reachable host bridge.

Changes:

• Adds and tests a shared base-URL derivation helper.
• Updates the Crush harness to use the helper.
• Recompiles affected workflows.

Show a summary per file

File	Description
actions/setup/js/awf_reflect.cjs	Adds and exports the URL helper.
actions/setup/js/awf_reflect.test.cjs	Adds helper regression tests.
.github/workflows/shared/crush.md	Applies the helper in the Crush harness.
.github/workflows/daily-arxiv-researcher.lock.yml	Regenerates the imported harness.
.github/workflows/daily-code-metrics.lock.yml	Regenerates the imported harness.
.github/workflows/smoke-crush.lock.yml	Regenerates the imported harness.

Review details

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 6/6 changed files
• Comments generated: 2
• Review effort level: Balanced

[Copilot]

@copilot apply to other definition based engine files

Applied in 59876dd: resolveOpenAICompatibleEndpointFromReflect() now also applies the api-proxy → host bridge rewrite, covering Goose-style definition-based engines, with a regression test for the bridged OpenAI-compatible endpoint path.

[github-actions]

🎉 This pull request is included in a new release.

Release: v0.86.3