Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion docs/awf-config-spec.md
Original file line number Diff line number Diff line change
Expand Up @@ -118,10 +118,13 @@ the corresponding CLI flag.
- `apiProxy.auth.gcpWorkloadIdentityProvider` → *(config-only; maps to `AWF_AUTH_GCP_WORKLOAD_IDENTITY_PROVIDER`)*
- `apiProxy.auth.gcpServiceAccount` → *(config-only; maps to `AWF_AUTH_GCP_SERVICE_ACCOUNT`)*
- `apiProxy.auth.gcpScope` → *(config-only; maps to `AWF_AUTH_GCP_SCOPE`)*
- `apiProxy.targets.<provider>.host` → `--<provider>-api-target`
- `apiProxy.targets.<provider>.host` → `--<provider>-api-target` *(except `antigravity.host`, which maps to the Gemini flag below)*
- `apiProxy.targets.antigravity.host` → `--gemini-api-target`
- `apiProxy.targets.openai.basePath` → `--openai-api-base-path`
- `apiProxy.targets.anthropic.basePath` → `--anthropic-api-base-path`
- `apiProxy.targets.gemini.basePath` → `--gemini-api-base-path`
- `apiProxy.targets.antigravity.basePath` → `--gemini-api-base-path`
- When both `apiProxy.targets.antigravity` and `apiProxy.targets.gemini` are set, `antigravity` takes precedence per field.
- `security.sslBump` → `--ssl-bump`
- `security.enableDlp` → `--enable-dlp`
- `security.enableHostAccess` → `--enable-host-access`
Expand Down
18 changes: 11 additions & 7 deletions docs/awf-config.schema.json
Original file line number Diff line number Diff line change
Expand Up @@ -49,7 +49,7 @@
"properties": {
"enabled": {
"type": "boolean",
"description": "Enable the API proxy sidecar container. When enabled, source credentials (OPENAI_API_KEY, ANTHROPIC_API_KEY, COPILOT_GITHUB_TOKEN, COPILOT_API_KEY, GEMINI_API_KEY) are held exclusively in the sidecar and excluded from the agent environment. The agent receives proxy-routing base URLs instead. See docs/awf-config-spec.md \u00a79 for credential isolation semantics."
"description": "Enable the API proxy sidecar container. When enabled, source credentials (OPENAI_API_KEY, ANTHROPIC_API_KEY, COPILOT_GITHUB_TOKEN, COPILOT_API_KEY, GEMINI_API_KEY) are held exclusively in the sidecar and excluded from the agent environment. The agent receives proxy-routing base URLs instead. See docs/awf-config-spec.md §9 for credential isolation semantics."
},
"enableTokenSteering": {
"type": "boolean",
Expand All @@ -70,11 +70,11 @@
"maxEffectiveTokens": {
"type": "integer",
"minimum": 1,
"description": "Maximum cumulative effective tokens allowed for a run. When reached, the API proxy rejects subsequent requests with HTTP 429 and error type 'effective_tokens_limit_exceeded'. Tokens are weighted: input \u00d71, cache-read \u00d70.1, output \u00d74, reasoning \u00d74. See spec \u00a710."
"description": "Maximum cumulative effective tokens allowed for a run. When reached, the API proxy rejects subsequent requests with HTTP 429 and error type 'effective_tokens_limit_exceeded'. Tokens are weighted: input ×1, cache-read ×0.1, output ×4, reasoning ×4. See spec §10."
},
"modelMultipliers": {
"type": "object",
"description": "Per-model multipliers for effective token accounting. Each model's weighted tokens are multiplied by this value before accumulation. Defaults to 1 for unlisted models. See spec \u00a710.2.",
"description": "Per-model multipliers for effective token accounting. Each model's weighted tokens are multiplied by this value before accumulation. Defaults to 1 for unlisted models. See spec §10.2.",
"additionalProperties": {
"type": "number",
"exclusiveMinimum": 0
Expand All @@ -83,7 +83,7 @@
"maxRuns": {
"type": "integer",
"minimum": 1,
"description": "Maximum number of LLM invocations allowed for a run. When reached, the API proxy rejects subsequent requests with HTTP 429 and error type 'max_runs_exceeded'. See spec \u00a711."
"description": "Maximum number of LLM invocations allowed for a run. When reached, the API proxy rejects subsequent requests with HTTP 429 and error type 'max_runs_exceeded'. See spec §11."
},
"modelFallback": {
"type": "object",
Expand Down Expand Up @@ -123,6 +123,10 @@
"gemini": {
"$ref": "#/$defs/providerTarget",
"description": "Google Gemini API target override."
},
"antigravity": {
"$ref": "#/$defs/providerTarget",
"description": "Antigravity API target override (alias of Gemini runtime settings)."
}
}
},
Expand All @@ -138,7 +142,7 @@
},
"auth": {
"type": "object",
"description": "Authentication configuration for the API proxy sidecar. Enables OIDC-based credential exchange (e.g., GitHub OIDC \u2192 Azure AD, AWS STS, or GCP Workload Identity). See docs/awf-config-spec.md \u00a79.5.",
"description": "Authentication configuration for the API proxy sidecar. Enables OIDC-based credential exchange (e.g., GitHub OIDC Azure AD, AWS STS, or GCP Workload Identity). See docs/awf-config-spec.md §9.5.",
"additionalProperties": false,
"properties": {
"type": {
Expand Down Expand Up @@ -399,7 +403,7 @@
},
"environment": {
"type": "object",
"description": "Environment variable propagation into the agent container. Merge behavior is: AWF-reserved variables are set by AWF and are not overridden by envAll or envFile; if envAll is true, host environment variables are forwarded next; envFile is then applied only for variables not already present, so it does not override envAll; CLI -e/--env has highest precedence and may override any variable, including AWF-reserved ones. When apiProxy.enabled is true, source credentials (OPENAI_API_KEY, ANTHROPIC_API_KEY, etc.) are excluded from the agent and held in the API proxy sidecar. See docs/awf-config-spec.md \u00a78\u20139 for credential isolation rules.",
"description": "Environment variable propagation into the agent container. Merge behavior is: AWF-reserved variables are set by AWF and are not overridden by envAll or envFile; if envAll is true, host environment variables are forwarded next; envFile is then applied only for variables not already present, so it does not override envAll; CLI -e/--env has highest precedence and may override any variable, including AWF-reserved ones. When apiProxy.enabled is true, source credentials (OPENAI_API_KEY, ANTHROPIC_API_KEY, etc.) are excluded from the agent and held in the API proxy sidecar. See docs/awf-config-spec.md §8–9 for credential isolation rules.",
"additionalProperties": false,
"properties": {
"envFile": {
Expand All @@ -408,7 +412,7 @@
},
"envAll": {
"type": "boolean",
"description": "Forward all host environment variables into the agent container. Use with caution \u2014 may expose secrets."
"description": "Forward all host environment variables into the agent container. Use with caution may expose secrets."
},
"excludeEnv": {
"type": "array",
Expand Down
Loading
Loading