feat: persist redacted resolved config as audit artifact (#4719)

* feat: persist redacted resolved config as audit artifact

Write awf-resolved-config.json (mode 0600) to the audit dir (or workDir
if no audit dir is set) at startup, before containers launch. This allows
post-run diagnostics to recover the full set of CLI options, domain
allowlists, network topology, and feature flags without requiring
--log-level debug or parsing step logs.

Security-sensitive fields (API keys, tokens) are excluded using the same
redaction logic already applied to the debug log. The agentCommand field
has secrets within it redacted.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix: update gh-aw-actions/setup SHA in workflow tests to v0.79.4

The recompile PR #4714 bumped the pinned action from v0.79.2 to v0.79.4
but didn't update the corresponding test assertions.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix: use module-level fs mocks, correct audit dir and permissions

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>

Author: 3 people

scripts/ci/security-guard-workflow.test.ts

@@ -38,7 +38,7 @@ describe('security guard workflow optimization config', () => {
     expect(lock).toContain('--max-turns 6');
     expect(lock).toContain('ANTHROPIC_MODEL: claude-sonnet-4-5');
     expect(lock).toContain('GH_AW_MAX_TURNS: 6');
-    expect(lock).toContain('github/gh-aw-actions/setup@9b1d730701c16b15673633e5696d01677fad9844 # v0.79.2');
+    expect(lock).toContain('github/gh-aw-actions/setup@d059700c6a8ec3b5fd798b9ea60f5d048447b918 # v0.79.4');
     expect(lock).not.toContain('github/gh-aw-actions/setup@v0.79.2');
     expect(lock).toContain('ghcr.io/github/github-mcp-server:v1.1.2');
   });

scripts/ci/test-coverage-improver-workflow.test.ts

@@ -75,7 +75,7 @@ describe('test coverage improver workflow token optimization config', () => {
     expect(lock).not.toContain("shell(cat:src/*.test.ts)");
     expect(lock).not.toContain("shell(npm run lint)");
     expect(lock).not.toContain("shell(npm run test)");
-    expect(lock).toContain('github/gh-aw-actions/setup@9b1d730701c16b15673633e5696d01677fad9844 # v0.79.2');
+    expect(lock).toContain('github/gh-aw-actions/setup@d059700c6a8ec3b5fd798b9ea60f5d048447b918 # v0.79.4');
     expect(lock).not.toContain('github/gh-aw-actions/setup@v0.79.2');
     expect(lock).toContain('ghcr.io/github/github-mcp-server:v1.1.2');
 

src/commands/main-action.test.ts

@@ -1,3 +1,20 @@
+// Module-level mock functions for fs — must be declared before jest.mock('fs')
+// so the factory can close over them. jest.mock is hoisted but the factory runs
+// lazily after module initialisation, when these variables are defined.
+const mockMkdirSync = jest.fn();
+const mockWriteFileSync = jest.fn();
+const mockChmodSync = jest.fn();
+
+jest.mock('fs', () => {
+  const actual = jest.requireActual<typeof import('fs')>('fs');
+  return {
+    ...actual,
+    mkdirSync: (...args: unknown[]) => mockMkdirSync(...args),
+    writeFileSync: (...args: unknown[]) => mockWriteFileSync(...args),
+    chmodSync: (...args: unknown[]) => mockChmodSync(...args),
+  };
+});
+
 import { createMainAction } from './main-action';
 
 // eslint-disable-next-line @typescript-eslint/no-require-imports
@@ -373,4 +390,81 @@ describe('createMainAction', () => {
       expect(serialized).not.toContain('gem-secret');
     });
   });
+
+  describe('resolved config artifact', () => {
+    beforeEach(() => {
+      mockMkdirSync.mockReset();
+      mockWriteFileSync.mockReset();
+      mockChmodSync.mockReset();
+    });
+
+    afterEach(() => jest.restoreAllMocks());
+
+    it('writes awf-resolved-config.json to audit dir when set', async () => {
+      const configWithAudit = {
+        ...STUB_CONFIG,
+        auditDir: '/tmp/awf-audit',
+      };
+      mockedValidateOptions.validateOptions.mockReturnValue(
+        configWithAudit as unknown as import('../types').WrapperConfig
+      );
+      const action = createMainAction(getOptionValueSource);
+      await action(['echo hi'], {});
+
+      expect(mockMkdirSync).toHaveBeenCalledWith('/tmp/awf-audit', { recursive: true, mode: 0o755 });
+      expect(mockWriteFileSync).toHaveBeenCalledWith(
+        '/tmp/awf-audit/awf-resolved-config.json',
+        expect.stringContaining('"allowedDomains"'),
+        { mode: 0o644 },
+      );
+      expect(mockChmodSync).toHaveBeenCalledWith('/tmp/awf-audit/awf-resolved-config.json', 0o644);
+      // Verify secret key names are excluded from the artifact
+      const written = mockWriteFileSync.mock.calls.find(
+        (c) => String(c[0]).includes('awf-resolved-config.json')
+      );
+      expect(written).toBeDefined();
+      const writtenJson = String(written![1]);
+      expect(writtenJson).not.toContain('ApiKey');
+      expect(writtenJson).not.toContain('GithubToken');
+    });
+
+    it('redacts secret values in agentCommand in the artifact', async () => {
+      const secretValue = 'super-secret-token-12345';
+      const configWithSecret = {
+        ...STUB_CONFIG,
+        auditDir: '/tmp/awf-audit',
+        agentCommand: `my-agent --token ${secretValue}`,
+      };
+      mockedValidateOptions.validateOptions.mockReturnValue(
+        configWithSecret as unknown as import('../types').WrapperConfig
+      );
+      // Make redactSecrets actually remove the secret value
+      mockedRedactSecrets.redactSecrets.mockImplementation((s: string) =>
+        s.replace(secretValue, '[REDACTED]')
+      );
+
+      const action = createMainAction(getOptionValueSource);
+      await action(['echo hi'], {});
+
+      const written = mockWriteFileSync.mock.calls.find(
+        (c) => String(c[0]).includes('awf-resolved-config.json')
+      );
+      expect(written).toBeDefined();
+      const writtenJson = String(written![1]);
+      expect(writtenJson).not.toContain(secretValue);
+      expect(writtenJson).toContain('[REDACTED]');
+    });
+
+    it('falls back to workDir/audit when auditDir is not set', async () => {
+      mockedValidateOptions.validateOptions.mockReturnValue(STUB_CONFIG);
+      const action = createMainAction(getOptionValueSource);
+      await action(['echo hi'], {});
+
+      expect(mockWriteFileSync).toHaveBeenCalledWith(
+        '/tmp/awf-test/audit/awf-resolved-config.json',
+        expect.any(String),
+        { mode: 0o644 },
+      );
+    });
+  });
 });

src/commands/main-action.ts

@@ -1,3 +1,5 @@
+import * as fs from 'fs';
+import * as path from 'path';
 import { logger } from '../logger';
 import {
   writeConfigs,
@@ -115,6 +117,22 @@ export function createMainAction(getOptionValueSource: OptionSourceResolver) {
     redactedConfig[key] = key === 'agentCommand' ? redactSecrets(value as string) : value;
   }
   logger.debug('Configuration:', JSON.stringify(redactedConfig, null, 2));
+
+  // Persist redacted config to audit artifact for post-run diagnostics
+  try {
+    const configArtifactDir = config.auditDir || path.join(config.workDir, 'audit');
+    fs.mkdirSync(configArtifactDir, { recursive: true, mode: 0o755 });
+    const configArtifactPath = path.join(configArtifactDir, 'awf-resolved-config.json');
+    fs.writeFileSync(
+      configArtifactPath,
+      JSON.stringify(redactedConfig, null, 2) + '\n',
+      { mode: 0o644 },
+    );
+    fs.chmodSync(configArtifactPath, 0o644);
+  } catch (err) {
+    logger.debug(`Failed to write resolved config artifact: ${err}`);
+  }
+
   logger.info(`Allowed domains: ${config.allowedDomains.join(', ')}`);
   if (config.blockedDomains && config.blockedDomains.length > 0) {
     logger.info(`Blocked domains: ${config.blockedDomains.join(', ')}`);