fix: create /tmp/gh-aw/mcp-logs before Docker mount

[Copilot]

Docker mount fails when target directory doesn't exist, causing container startup to fail with "not a directory" error when attempting to mount /dev/null over /tmp/gh-aw/mcp-logs for credential hiding.

Changes

• src/docker-manager.ts: Create /tmp/gh-aw/mcp-logs in writeConfigs() before container startup
• src/docker-manager.test.ts: Add test verifying directory creation

Context

The firewall hides MCP server logs via /dev/null overlay mounts (lines 670, 703) to prevent exfiltration. Docker requires the mount target to exist beforehand.

// Create /tmp/gh-aw/mcp-logs directory for hiding via /dev/null mount
// This directory must exist before Docker tries to mount /dev/null over it
const mcpLogsDir = '/tmp/gh-aw/mcp-logs';
if (!fs.existsSync(mcpLogsDir)) {
  fs.mkdirSync(mcpLogsDir, { recursive: true, mode: 0o755 });
  logger.debug(`MCP logs directory created at: ${mcpLogsDir}`);
}

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[Copilot]

Pull request overview

Fixes a Docker startup failure caused by mounting /dev/null onto a non-existent target directory (/tmp/gh-aw/mcp-logs) used for hiding MCP server logs in selective mounting mode.

Changes:

• Create /tmp/gh-aw/mcp-logs during writeConfigs() before containers start.
• Add a Jest test intended to verify the directory is created.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
src/docker-manager.ts	Ensures /tmp/gh-aw/mcp-logs exists prior to Docker volume mounts used for MCP log hiding.
src/docker-manager.test.ts	Adds a unit test checking that /tmp/gh-aw/mcp-logs exists after writeConfigs().

Comments suppressed due to low confidence (1)

src/docker-manager.ts:876

• writeConfigs() currently creates /tmp/gh-aw/mcp-logs unconditionally, even when allowFullFilesystemAccess is enabled (i.e., when the /dev/null hiding mount isn’t added). If possible, gate this directory creation behind the same condition that adds the mount to reduce side effects on the host filesystem.

  // Create /tmp/gh-aw/mcp-logs directory for hiding via /dev/null mount
  // This directory must exist before Docker tries to mount /dev/null over it
  // (selective mounting mode hides this directory to prevent MCP log exfiltration)
  const mcpLogsDir = '/tmp/gh-aw/mcp-logs';
  if (!fs.existsSync(mcpLogsDir)) {
    fs.mkdirSync(mcpLogsDir, { recursive: true, mode: 0o755 });

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

fs.existsSync(mcpLogsDir) only checks that the path exists, not that it’s a directory. If /tmp/gh-aw/mcp-logs exists as a regular file (or symlink), this code will skip mkdirSync and Docker will still fail with the same “not a directory” mount error. Consider validating with fs.statSync/lstatSync and either replacing non-directories with a directory or throwing a clear error.

This issue also appears on line 871 of the same file.

[Copilot]

This test can pass even if /tmp/gh-aw/mcp-logs already existed before the test ran, so it may not actually validate the new directory-creation behavior. It also leaves /tmp/gh-aw/mcp-logs behind after the suite completes. Consider making the test hermetic by ensuring the path does not exist in setup (and cleaning it up in teardown), or by mocking/spying on fs.existsSync/fs.mkdirSync to assert the creation call happens.