fix(api-proxy): route OIDC agent traffic + async model fetch

Agent-Logs-Url: https://github.com/github/gh-aw-firewall/sessions/abb4f8bb-9660-48aa-b1d6-12d4501112be

Author: Copilot

containers/api-proxy/providers/openai.js

@@ -109,13 +109,24 @@ function createOpenAIAdapter(env, deps = {}) {
      * Returns the model-list fetch config for /reflect model population, or null.
      * Uses the configured base path so prefixed OpenAI-compatible deployments
      * (e.g. Databricks, Azure) populate /reflect and models.json correctly.
-     * OIDC auth is async so model fetching is skipped at startup — the model list
-     * will be populated on the first authenticated request.
      *
-     * @returns {{ url: string, opts: object, cacheKey: string }|null}
+     * When OIDC is configured, this method is async — it acquires a fresh token so
+     * that fetchStartupModels() can populate cachedModels.openai. This ensures that
+     * AWF_MODEL_ALIASES entries targeting `openai/*` resolve correctly and that
+     * /reflect and models.json show the available Azure OpenAI models.
+     *
+     * @returns {Promise<{ url: string, opts: object, cacheKey: string }|null>|{ url: string, opts: object, cacheKey: string }|null}
      */
-    getModelsFetchConfig() {
-      if (oidcEnabled) return null; // token not yet available at startup
+    async getModelsFetchConfig() {
+      if (oidcEnabled) {
+        const token = await oidcAuth.getToken();
+        const modelsPath = basePath ? `${basePath}/models` : '/v1/models';
+        return {
+          url: `https://${rawTarget}${modelsPath}`,
+          opts: { method: 'GET', headers: { 'Authorization': `Bearer ${token}` } },
+          cacheKey: 'openai',
+        };
+      }
       if (!apiKey) return null;
       const modelsPath = basePath ? `${basePath}/models` : '/v1/models';
       return {

containers/api-proxy/server.js

@@ -1108,12 +1108,14 @@ async function fetchStartupModels(adaptersOrOverrides = {}) {
     const fetches = [];
 
     for (const adapter of adapters) {
-      const config = adapter.getModelsFetchConfig?.();
-      if (!config) continue;
-
+      // getModelsFetchConfig() may return a plain config object or a Promise<config>
+      // (e.g. OIDC-backed adapters need to acquire a token asynchronously first).
       fetches.push(
-        fetchJson(config.url, config.opts, TIMEOUT_MS).then((json) => {
-          cachedModels[config.cacheKey] = extractModelIds(json);
+        Promise.resolve(adapter.getModelsFetchConfig?.()).then((config) => {
+          if (!config) return;
+          return fetchJson(config.url, config.opts, TIMEOUT_MS).then((json) => {
+            cachedModels[config.cacheKey] = extractModelIds(json);
+          });
         })
       );
     }

containers/api-proxy/server.test.js

@@ -1353,9 +1353,21 @@ describe('createOpenAIAdapter — OIDC auth', () => {
     expect(probe.reason).toMatch(/OIDC/i);
   });
 
-  it('getModelsFetchConfig() returns null when OIDC is enabled (deferred to runtime)', () => {
-    const adapter = createOpenAIAdapter({}, { oidcAuth: makeMockOidcManager({ enabled: true }) });
-    expect(adapter.getModelsFetchConfig()).toBeNull();
+  it('getModelsFetchConfig() returns async config with Bearer token when OIDC is enabled', async () => {
+    const adapter = createOpenAIAdapter(
+      { OPENAI_API_TARGET: 'myaccount.openai.azure.com', OPENAI_API_BASE_PATH: '/openai/deployments/gpt-4' },
+      { oidcAuth: makeMockOidcManager({ token: 'az-token-abc' }) }
+    );
+    const config = await adapter.getModelsFetchConfig();
+    expect(config).not.toBeNull();
+    expect(config.cacheKey).toBe('openai');
+    expect(config.url).toBe('https://myaccount.openai.azure.com/openai/deployments/gpt-4/models');
+    expect(config.opts.headers.Authorization).toBe('Bearer az-token-abc');
+  });
+
+  it('getModelsFetchConfig() propagates OIDC token errors', async () => {
+    const adapter = createOpenAIAdapter({}, { oidcAuth: makeMockOidcManager({ error: 'token expired' }) });
+    await expect(adapter.getModelsFetchConfig()).rejects.toThrow('token expired');
   });
 
   it('getReflectionInfo().configured is true when OIDC is enabled', () => {
@@ -1949,6 +1961,34 @@ describe('fetchStartupModels', () => {
     const reflect = reflectEndpoints();
     expect(reflect.models_fetch_complete).toBe(true);
   });
+
+  it('adapter-based: supports async getModelsFetchConfig (e.g. OIDC)', async () => {
+    mockHttpsRequestWithBody(200, '{"data":[{"id":"gpt-4o"},{"id":"gpt-4o-mini"}]}');
+
+    // Adapter with async getModelsFetchConfig simulating OIDC token acquisition
+    const oidcAdapter = {
+      name: 'openai-oidc',
+      getModelsFetchConfig: async () => ({
+        url: 'https://myaccount.openai.azure.com/openai/deployments/gpt-4/models',
+        opts: { method: 'GET', headers: { 'Authorization': 'Bearer az-oidc-token' } },
+        cacheKey: 'openai',
+      }),
+    };
+
+    await fetchStartupModels([oidcAdapter]);
+    expect(cachedModels.openai).toEqual(['gpt-4o', 'gpt-4o-mini']);
+  });
+
+  it('adapter-based: handles null from async getModelsFetchConfig gracefully', async () => {
+    const spy = jest.spyOn(https, 'request');
+    const adapter = {
+      name: 'no-config',
+      getModelsFetchConfig: async () => null,
+    };
+    await fetchStartupModels([adapter]);
+    expect(spy).not.toHaveBeenCalled();
+    expect(cachedModels).toEqual({});
+  });
 });
 
 // ── reflectEndpoints ───────────────────────────────────────────────────────

src/compose-generator.ts

@@ -1420,6 +1420,15 @@ export function generateDockerCompose(
       environment.OPENAI_API_KEY = 'sk-placeholder-for-api-proxy';
       environment.CODEX_API_KEY = 'sk-placeholder-for-api-proxy';
       logger.debug('OPENAI_API_KEY and CODEX_API_KEY set to placeholder values for credential isolation');
+    } else if (process.env.AWF_AUTH_TYPE === 'github-oidc') {
+      // OIDC-only mode (no static OPENAI_API_KEY): the api-proxy sidecar will acquire a
+      // short-lived Azure AD token via GitHub OIDC federation. We still need to point the
+      // agent at the proxy so it routes OpenAI traffic through the sidecar instead of
+      // connecting directly to the upstream host.
+      environment.OPENAI_BASE_URL = `http://${networkConfig.proxyIp}:${API_PROXY_PORTS.OPENAI}`;
+      environment.OPENAI_API_KEY = 'sk-placeholder-for-oidc-proxy';
+      environment.CODEX_API_KEY = 'sk-placeholder-for-oidc-proxy';
+      logger.debug(`OpenAI API will be proxied through sidecar (OIDC auth) at http://${networkConfig.proxyIp}:${API_PROXY_PORTS.OPENAI}`);
     }
     if (config.anthropicApiKey) {
       environment.ANTHROPIC_BASE_URL = `http://${networkConfig.proxyIp}:${API_PROXY_PORTS.ANTHROPIC}`;

src/docker-manager-compose.test.ts

@@ -2658,6 +2658,37 @@ describe('docker-manager generateDockerCompose', () => {
             expect(env[key]).toBeUndefined();
           }
         });
+
+        it('should set OPENAI_BASE_URL and placeholder keys in agent when AWF_AUTH_TYPE=github-oidc (no static key)', () => {
+          process.env.AWF_AUTH_TYPE = 'github-oidc';
+          // No openaiApiKey in config — OIDC-only mode
+          const config = { ...mockConfig, enableApiProxy: true };
+          const result = generateDockerCompose(config, mockNetworkConfigWithProxy);
+          const agentEnv = result.services.agent.environment as Record<string, string>;
+          expect(agentEnv.OPENAI_BASE_URL).toBe('http://172.30.0.30:10000');
+          expect(agentEnv.OPENAI_API_KEY).toBe('sk-placeholder-for-oidc-proxy');
+          expect(agentEnv.CODEX_API_KEY).toBe('sk-placeholder-for-oidc-proxy');
+        });
+
+        it('should not set OPENAI_BASE_URL in agent when enableApiProxy is false even if AWF_AUTH_TYPE=github-oidc', () => {
+          process.env.AWF_AUTH_TYPE = 'github-oidc';
+          // api-proxy not enabled — OIDC env vars are irrelevant
+          const config = { ...mockConfig, enableApiProxy: false };
+          const result = generateDockerCompose(config, mockNetworkConfigWithProxy);
+          const agentEnv = result.services.agent.environment as Record<string, string>;
+          expect(agentEnv.OPENAI_BASE_URL).toBeUndefined();
+        });
+
+        it('should prefer static key placeholder over OIDC placeholder when both are configured', () => {
+          process.env.AWF_AUTH_TYPE = 'github-oidc';
+          // Static key takes precedence (existing behavior is preserved)
+          const config = { ...mockConfig, enableApiProxy: true, openaiApiKey: 'sk-static' };
+          const result = generateDockerCompose(config, mockNetworkConfigWithProxy);
+          const agentEnv = result.services.agent.environment as Record<string, string>;
+          expect(agentEnv.OPENAI_BASE_URL).toBe('http://172.30.0.30:10000');
+          expect(agentEnv.OPENAI_API_KEY).toBe('sk-placeholder-for-api-proxy');
+          expect(agentEnv.CODEX_API_KEY).toBe('sk-placeholder-for-api-proxy');
+        });
       });
 
       it('should set OPENAI_API_TARGET in api-proxy when openaiApiTarget is provided', () => {