Repository navigation
feat(coder-acp-copilot-windows): enable HAR capture via gateway proxy - #1058
Cedric Vidal (cedricvidal) wants to merge 3 commits into
Conversation
Add gateway proxy integration to the Windows worker so it captures HTTP traffic for the Tool Calls tab. Uses NODE_EXTRA_CA_CERTS instead of certutil.exe (which caused STATUS_STACK_BUFFER_OVERRUN crashes). Changes: - Windows worker: add proxy setup with GatewayClient, graceful fallback - shared/devproxy: make createCombinedCaBundle cross-platform (skip Linux system CA paths on Windows) - deploy: add PROXY_BACKEND, DEV_PROXY_API_URL, DEV_PROXY_ENABLED to Windows worker deployment Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…env-proxy Node.js 22.16.0 does not support --use-env-proxy (added in 22.21.0). Without it, undici/fetch ignores HTTP_PROXY env vars entirely and no traffic flows through the gateway proxy for HAR capture. Upgrade the Windows base image to Node.js 22.22.3 (latest LTS) which supports --use-env-proxy in NODE_OPTIONS. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…lot_token plugin The copilot_token plugin in the gateway attempts to mint fresh tokens via Token Manager for every Copilot API request. On Windows, the CLI already handles its own token lifecycle, making the plugin unnecessary and causing 502 errors when Token Manager lacks valid keys. Add GATEWAY_TOKEN_PLUGIN_ENABLED env var (default: enabled) that workers can set to 'false' to skip the plugin. Set it in the Windows worker deployment. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
|
Original author: @github-actions[bot] Test Results (Node.js 22)test: Run #1863
🎉 All tests passed! |
|
Original author: Josh Duffney (@duffney) Created #1075 to track the shared proxy/HAR lifecycle refactor as a follow-up (per @cedricvidal_microsoft's review comment). Makes sense to tackle alongside the DevProxy → AI Gateway migration. |
|
Original author: Cedric Vidal (@cedricvidal) Approve with one remark regarding the sharing of some of the logic accross all ACP workers but might be better as a followup issue. More info in code comment |
|
Original author: Josh Duffney (@duffney) Original review: COMMENTED |
|
Original author: Cedric Vidal (@cedricvidal) I feel like some of this logic should be shared between the ACP workers but it might be easier to do so at the same time we migrate all ACP workers from DevProxy to the AI Gateway. So maybe as a followup issue. |
|
Original author: Josh Duffney (@duffney) Created a new isssue for tracking it. I'll merge it in as is. Thanks for the review! |
Original author: Josh Duffney (@duffney)
Motivation
The Windows
coder-acp-copilot-windowsworker had no HAR capture support, meaning the Tool Calls tab in the portal was empty for Windows runs. This implements the same gateway proxy integration that the Linux worker already uses, enabling full LLM call visibility for Windows-based benchmarks.Closes growth-ecosystems/scope-project#109
Approach
Mirrors the Linux worker's proxy integration pattern with Windows-specific adaptations:
processMessage(): creates a session, downloads the CA cert, sets proxy env vars for the subprocess, and collects the HAR on completion or failure.buildSubprocessEnv()configuresHTTP_PROXY,HTTPS_PROXY,NODE_EXTRA_CA_CERTS,NODE_TLS_REJECT_UNAUTHORIZED, and--use-env-proxyinNODE_OPTIONSso Node.js's undici routes traffic through the gateway.proxy-client.ts: skips Linux-only system CA paths on Windows (avoids ENOENT errors).GATEWAY_TOKEN_PLUGIN_ENABLEDflag in the shared devproxy module: allows workers to disable the gateway'scopilot_tokenplugin per-session. The Windows worker sets this tofalsebecause the Copilot CLI manages its own token lifecycle.--use-env-proxywas only added in Node 22.21.0.Key decisions
copilot_tokengateway plugin is disabled for Windows because the CLI already handles token refresh internally, and the plugin requires Token Manager keys that may not be configured in all environments.NODE_TLS_REJECT_UNAUTHORIZED=0is set for the subprocess since the gateway's MITM cert is self-signed.NODE_EXTRA_CA_CERTSis also set as a belt-and-suspenders approach.NO_PROXYexcludesgithub.comandapi.github.comto avoid intercepting initial auth flows.Testing
Verified end-to-end on the dev AKS cluster (
aks-scope-v2-dev):3457bf11-e63b-4799-8d49-85443c687690completed successfully