Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions docs/awf-config-spec.md
Original file line number Diff line number Diff line change
Expand Up @@ -96,8 +96,11 @@ the corresponding CLI flag.
- `network.upstreamProxy` → `--upstream-proxy`
- `apiProxy.enabled` → `--enable-api-proxy`
- `apiProxy.enableOpenCode` → `--enable-opencode`
- `apiProxy.anthropicAutoCache` → `--anthropic-auto-cache`
- `apiProxy.anthropicCacheTailTtl` → `--anthropic-cache-tail-ttl <5m|1h>`
- `apiProxy.maxEffectiveTokens` → *(config-only; no CLI equivalent)*
- `apiProxy.modelMultipliers` → *(config-only; no CLI equivalent)*
- `apiProxy.models` → *(config-only; model alias rewriting)*
- `apiProxy.targets.<provider>.host` → `--<provider>-api-target`
- `apiProxy.targets.openai.basePath` → `--openai-api-base-path`
- `apiProxy.targets.anthropic.basePath` → `--anthropic-api-base-path`
Expand Down
4 changes: 2 additions & 2 deletions src/awf-config-schema.json
Original file line number Diff line number Diff line change
Expand Up @@ -49,7 +49,7 @@
"properties": {
"enabled": {
"type": "boolean",
"description": "Enable the API proxy sidecar container."
"description": "Enable the API proxy sidecar container. When enabled, source credentials (OPENAI_API_KEY, ANTHROPIC_API_KEY, COPILOT_GITHUB_TOKEN, COPILOT_API_KEY, GEMINI_API_KEY) are held exclusively in the sidecar and excluded from the agent environment. The agent receives proxy-routing base URLs instead. See docs/awf-config-spec.md §9 for credential isolation semantics."
},
"enableOpenCode": {
"type": "boolean",
Expand Down Expand Up @@ -235,7 +235,7 @@
},
"environment": {
"type": "object",
"description": "Environment variable propagation into the agent container.",
"description": "Environment variable propagation into the agent container. Variables are merged in precedence order: AWF-reserved (lowest) → envFile → envAll → CLI -e/--env (highest). When apiProxy.enabled is true, source credentials (OPENAI_API_KEY, ANTHROPIC_API_KEY, etc.) are excluded from the agent and held in the API proxy sidecar. See docs/awf-config-spec.md §8–9 for normative merge and credential isolation rules.",
"additionalProperties": false,
"properties": {
"envFile": {
Expand Down
Loading