Skip to content

Remove SRT (Sandbox Runtime) support, keep AWF only#15834

Merged
pelikhan merged 5 commits intomainfrom
copilot/remove-srt-support
Feb 15, 2026
Merged

Remove SRT (Sandbox Runtime) support, keep AWF only#15834
pelikhan merged 5 commits intomainfrom
copilot/remove-srt-support

Conversation

Copy link
Contributor

Copilot AI commented Feb 15, 2026

Removes Anthropic Sandbox Runtime (SRT) as a sandbox backend. AWF (Agent Workflow Firewall) is now the only supported sandbox implementation. Legacy workflows using sandbox.agent: srt or sandbox: sandbox-runtime are automatically migrated to AWF via migrateSRTToAWF().

Changes

Schema & Types

  • Removed "srt" and "sandbox-runtime" from JSON schema enums
  • Removed SandboxTypeSRT and SandboxTypeRuntime type constants
  • Removed DefaultSandboxRuntimeVersion and SandboxRuntimeFeatureFlag constants

Code Removal (~700 lines)

  • Deleted isSRTEnabled() and generateSRTConfigJSON() functions
  • Removed SRT installation steps (generateSRTSystemDepsStep, generateSRTInstallationStep, generateSRTWrapperScript)
  • Removed SRT execution paths from copilot_engine_execution.go and copilot_engine_installation.go
  • Removed SRT validation logic from sandbox_validation.go and strict_mode_validation.go
  • Renamed copilot_srt.gocopilot_installer.go (kept non-SRT functions like GenerateCopilotInstallerSteps)

Migration

  • Added migrateSRTToAWF() codemod in sandbox.go that converts SRT references to AWF during workflow parsing
  • Called automatically from applySandboxDefaults()

CLI Workflow

  • Removed Sandbox Runtime monitoring from cli-version-checker.md

Migration Example

# Before (automatically migrated)
sandbox:
  agent: srt

# After (transparent conversion)
sandbox:
  agent: awf

All 154 workflows recompiled successfully with the changes.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

  • https://api.github.com/graphql
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw (http block)
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw g/workflow/actiostatus g/workflow/actio--porcelain g/workflow/action_pins_logging_test.go g/wo�� g/workflow/action_reference.go g/workflow/action_reference_test.go g/workflow/action_resolver.go g/workflow/actiogit g/workflow/actiorev-parse g/workflow/actio--show-toplevel g/workflow/action_sha_checker_te../../../**/*.json (http block)
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw g/workflow/copil-C g/workflow/copil/home/REDACTED/work/gh-aw/gh-aw/.github/workflows g/workflow/copilconfig g/wo�� */*.json' '!../.remote.origin.url g/workflow/copilot_session_jsonl_test.go de/node/bin/bash (http block)
  • https://api.github.com/repos/actions/ai-inference/git/ref/tags/v1
    • Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq .object.sha -json GO111MODULE /opt/hostedtoolcache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE ache/node/24.13.0/x64/bin/node GOINSECURE GOMOD GOMODCACHE ache/node/24.13.0/x64/bin/node (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq .object.sha user.name Test User /usr/bin/git -json (http block)
  • https://api.github.com/repos/actions/ai-inference/git/ref/tags/v2
    • Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v2 --jq .object.sha --get-regexp --global bash (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v2 --jq .object.sha cp .github/aw/actions-lock.json pkg/workflow/data/action_pins.json; \ echo "��� Action pins syn/usr/bin/gh --global $name) { hasDiscussionsEnabled } } (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/11bd71901bbe5b1630ceea73d27597364c9af683
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/11bd71901bbe5b1630ceea73d27597364c9af683 --jq .object.sha get --global 0/x64/bin/npm http.https://gitinfocmp (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v3
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq .object.sha -json GO111MODULE ache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE ache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq .object.sha --show-toplevel go /usr/bin/git TH" GO111MODULE ache/go/1.25.0/x--show-toplevel git rev-�� --show-toplevel go /usr/bin/git -json GO111MODULE (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v4 --jq .object.sha -json GO111MODULE /opt/hostedtoolcache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE /opt/hostedtoolcache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v4 --jq .object.sha a/action_pins.json GO111MODULE /opt/hostedtoolcache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env runs/20260215-021330-73197/test-4242717967/.github/workflows GO111MODULE /opt/hostedtoolcache/go/1.25.0/x64/bin/go l GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v4 --jq .object.sha xterm-color go /usr/bin/git 345 GO111MODULE 64/pkg/tool/linu--show-toplevel git rese�� HEAD hanges) /usr/bin/git g_.a GO111MODULE 64/bin/go git (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v5
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha mNNW/Rj8M4CMnMnoi6XV4mNNW GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE 6292273/b391/imp1 -c che/go-build/d8/test-logs/run-1 GOPROXY 64/pkg/tool/linux_amd64/vet GOSUMDB GOWORK 64/bin/go 64/pkg/tool/linuconfig (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha -json GO111MODULE /usr/bin/git GOINSECURE GOMOD GOMODCACHE git conf�� user.name Test User /usr/bin/git GOSUMDB GOWORK 64/bin/go git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha Actor: ${{ github.actor }}, Repo: ${{ github.repository }} go /usr/bin/git -json GO111MODULE 64/bin/go git conf�� user.email test@example.com /usr/bin/git -json GO111MODULE 64/bin/go git (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v6
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha get --local de/node/bin/sh pull.rebase (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha get o x_amd64/asm (http block)
  • https://api.github.com/repos/actions/download-artifact/git/ref/tags/v6
    • Triggering command: /usr/bin/gh gh api /repos/actions/download-artifact/git/ref/tags/v6 --jq .object.sha js/**/*.json' ---p (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/download-artifact/git/ref/tags/v6 --jq .object.sha origin main ache/go/1.25.0/x64/bin/bash (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/download-artifact/git/ref/tags/v6 --jq .object.sha tted" (http block)
  • https://api.github.com/repos/actions/github-script/git/ref/tags/v7
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v7 --jq .object.sha (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v7 --jq .object.sha get --local cal/bin/bash pull.rebase (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v7 --jq .object.sha '**/*.ts' '**/*.json' --ignore-path ../../../.pr**/*.json as/main_workflow_schema.json /home/REDACTED/work/_temp/ghcca-node/node/bin/git (http block)
  • https://api.github.com/repos/actions/github-script/git/ref/tags/v8
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha it/ref/tags/v6 (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha rt-support (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha go1.25.0 -c=4 -nolocalimports -importcfg /tmp/go-build4099443047/b389/importcfg -pack /tmp/go-build4099443047/b389/_testmain.go -c npx prettier --w-errorsas (http block)
  • https://api.github.com/repos/actions/setup-go/git/ref/tags/4dc6199c7b1a012772edbd06daecab0f50c9053c
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/4dc6199c7b1a012772edbd06daecab0f50c9053c --jq .object.sha d -n 10 credential.helper odules/npm/node_modules/@npmcli/run-script/lib/node-gyp-bin/sh (http block)
  • https://api.github.com/repos/actions/setup-go/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha 92 GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env runs/20260215-021330-73197/test-1250258005/.github/workflows GO111MODULE /opt/hostedtoolcache/go/1.25.0/x64/bin/go l GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha --show-toplevel go /usr/bin/git -json GO111MODULE 4124107/b297/vet--show-toplevel git add . go /usr/bin/git -json GO111MODULE /opt/hostedtoolc--show-toplevel git (http block)
  • https://api.github.com/repos/actions/setup-go/git/ref/tags/v5
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v5 --jq .object.sha th .prettierignore (http block)
  • https://api.github.com/repos/actions/setup-go/git/ref/tags/v6
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v6 --jq .object.sha w/js/**/*.json' --ignore-path (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v6 --jq .object.sha llector.slice (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v6 --jq .object.sha js/**/*.json' --ignore-path ../../../.prettierignore (http block)
  • https://api.github.com/repos/actions/setup-node/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE ache/node/24.13.0/x64/bin/node GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha --show-toplevel go /usr/bin/git runs/20260215-02git GO111MODULE /opt/hostedtoolc--show-toplevel git estl�� HEAD go /usr/bin/git -json GO111MODULE /opt/hostedtoolc--show-toplevel git (http block)
  • https://api.github.com/repos/actions/setup-node/git/ref/tags/v6
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6 --jq .object.sha w/js/**/*.json' --ignore-path (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6 --jq .object.sha js/**/*.json' --ignore-path ../../../.prettierignore (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6 --jq .object.sha ot_engine.go ot_engine_execution.go odules/npm/node_modules/@npmcli/run-script/lib/node-gyp-bin/node ot_engine_test.g/opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/cgo ot_engine_tools.-V=full ot_git_commands_integration_test"prettier" --write 'scripts/**/*.js' --ignore-path .prettierignore ot_github_mcp_test.go ot_i�� ot_installer_test.go ot_logs.go ot_mcp.go ot_mcp_http_integh ot_participant_sapi ot_participant_s/repos/actions/upload-artifact/git/ref/tags/v6 ot_sdk_engine.go--jq (http block)
  • https://api.github.com/repos/actions/upload-artifact/git/ref/tags/v6
    • Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v6 --jq .object.sha w/js/**/*.json' --ignore-path (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v6 --jq .object.sha w/js/**/*.json' --ignore-path ../../../.prettierignore (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v6 --jq .object.sha w/js/**/*.json' --ignore-path ../../../.prettierignore _test.go (http block)
  • https://api.github.com/repos/anchore/sbom-action/git/ref/tags/v0
    • Triggering command: /usr/bin/gh gh api /repos/anchore/sbom-action/git/ref/tags/v0 --jq .object.sha get --local /opt/pipx_bin/gi-f pull.rebase (http block)
    • Triggering command: /usr/bin/gh gh api /repos/anchore/sbom-action/git/ref/tags/v0 --jq .object.sha --local credential.username 8d519d9/node_modules/.bin/prettier (http block)
    • Triggering command: /usr/bin/gh gh api /repos/anchore/sbom-action/git/ref/tags/v0 --jq .object.sha d -n 10 credential.helper 0/x64/bin/node (http block)
  • https://api.github.com/repos/docker/build-push-action/git/ref/tags/v6
    • Triggering command: /usr/bin/gh gh api /repos/docker/build-push-action/git/ref/tags/v6 --jq .object.sha ormat:cjs --local x_amd64/link pull.rebase (http block)
    • Triggering command: /usr/bin/gh gh api /repos/docker/build-push-action/git/ref/tags/v6 --jq .object.sha '**/*.ts' '**/*.json' --ignore-path ../../../.pr**/*.json credential.username $name) { hasDiscussionsEnabled } } (http block)
    • Triggering command: /usr/bin/gh gh api /repos/docker/build-push-action/git/ref/tags/v6 --jq .object.sha d -n 10 credential.helpeowner=github bin/sh (http block)
  • https://api.github.com/repos/docker/login-action/git/ref/tags/v3
    • Triggering command: /usr/bin/gh gh api /repos/docker/login-action/git/ref/tags/v3 --jq .object.sha '**/*.ts' '**/*.json' --ignore-path ../../../.pr**/*.json credential.username cal/bin/bash (http block)
    • Triggering command: /usr/bin/gh gh api /repos/docker/login-action/git/ref/tags/v3 --jq .object.sha '**/*.ts' '**/*.-f credential.usernowner=github bash (http block)
  • https://api.github.com/repos/docker/metadata-action/git/ref/tags/v5
    • Triggering command: /usr/bin/gh gh api /repos/docker/metadata-action/git/ref/tags/v5 --jq .object.sha '**/*.ts' '**/*.json' --ignore-path ../../../.pr**/*.json credential.username e_modules/node_modules/.bin/sh Action pins syngit (http block)
    • Triggering command: /usr/bin/gh gh api /repos/docker/metadata-action/git/ref/tags/v5 --jq .object.sha d -n 10 credential.helper tions/setup/node_modules/.bin/sh (http block)
  • https://api.github.com/repos/docker/setup-buildx-action/git/ref/tags/v3
    • Triggering command: /usr/bin/gh gh api /repos/docker/setup-buildx-action/git/ref/tags/v3 --jq .object.sha get --local p/bin/bash pull.rebase (http block)
    • Triggering command: /usr/bin/gh gh api /repos/docker/setup-buildx-action/git/ref/tags/v3 --jq .object.sha '**/*.ts' '**/*.-f credential.usernowner=github bin/node (http block)
    • Triggering command: /usr/bin/gh gh api /repos/docker/setup-buildx-action/git/ref/tags/v3 --jq .object.sha d -n 10 credential.helper de_modules/.bin/sh (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/1/artifacts
    • Triggering command: /usr/bin/gh gh run download 1 --dir test-logs/run-1 (http block)
    • Triggering command: /usr/bin/gh gh run download 1 --dir test-logs/run-1 GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh run download 1 --dir test-logs/run-1 GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env 6292273/b395/_pkg_.a GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/12345/artifacts
    • Triggering command: /usr/bin/gh gh run download 12345 --dir test-logs/run-12345 --jq 64/pkg/tool/linux_amd64/vet -c=4 -nolocalimports -importcfg 64/pkg/tool/linux_amd64/vet -1 xterm-color .cfg 64/pkg/tool/linux_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh run download 12345 --dir test-logs/run-12345 GO111MODULE x_amd64/cgo GOINSECURE GOMOD GOMODCACHE x_amd64/cgo env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh run download 12345 --dir test-logs/run-12345 GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE ache/go/1.25.0/x.github/workflows/test.md env 6292273/b379/_pkg_.a GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/12346/artifacts
    • Triggering command: /usr/bin/gh gh run download 12346 --dir test-logs/run-12346 (http block)
    • Triggering command: /usr/bin/gh gh run download 12346 --dir test-logs/run-12346 GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh run download 12346 --dir test-logs/run-12346 GO111MODULE x_amd64/link GOINSECURE GOMOD GOMODCACHE x_amd64/link env 6292273/b377/_pk@{u} GO111MODULE 64/bin/go GOINSECURE ng/gheAv75hp96Tfrev-parse GOMODCACHE go (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/2/artifacts
    • Triggering command: /usr/bin/gh gh run download 2 --dir test-logs/run-2 --jq x_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh run download 2 --dir test-logs/run-2 GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh run download 2 --dir test-logs/run-2 GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env 6292273/b391/_pkg_.a GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/3/artifacts
    • Triggering command: /usr/bin/gh gh run download 3 --dir test-logs/run-3 (http block)
    • Triggering command: /usr/bin/gh gh run download 3 --dir test-logs/run-3 GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh run download 3 --dir test-logs/run-3 GO111MODULE x_amd64/link GOINSECURE GOMOD GOMODCACHE x_amd64/link env 6292273/b397/_pkg_.a GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/4/artifacts
    • Triggering command: /usr/bin/gh gh run download 4 --dir test-logs/run-4 --jq 64/pkg/tool/linux_amd64/link l (http block)
    • Triggering command: /usr/bin/gh gh run download 4 --dir test-logs/run-4 GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh run download 4 --dir test-logs/run-4 GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env 6292273/b399/_pkg_.a GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/5/artifacts
    • Triggering command: /usr/bin/gh gh run download 5 --dir test-logs/run-5 (http block)
    • Triggering command: /usr/bin/gh gh run download 5 --dir test-logs/run-5 GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh run download 5 --dir test-logs/run-5 GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env 6292273/b401/_pkg_.a GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/github/gh-aw/actions/workflows
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path --noprofile (http block)
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 100 --ignore-path ../../../.pretti-bool sh -c ../actions/setu-errorsas (http block)
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 6 (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/c4e091835c7a94dc7d3acb8ed3ae145afb4995f3
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/c4e091835c7a94dc7d3acb8ed3ae145afb4995f3 --jq .object.sha json' --ignore-path ../../../.prettierignore r _modules/.bin/sh (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE node (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq .object.sha --show-toplevel go /usr/bin/git e-analyzer.md GO111MODULE 64/bin/go git rev-�� --show-toplevel go 64/bin/node ck '**/*.cjs' '*git GO111MODULE x_amd64/vet git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq .object.sha --show-toplevel go /usr/bin/git -json GO111MODULE 64/bin/go git rev-�� --show-toplevel sh /usr/bin/git "prettier" --chegit GOPROXY ache/go/1.25.0/x--show-toplevel git (http block)
  • https://api.github.com/repos/githubnext/agentics/git/ref/tags/-
    • Triggering command: /usr/bin/gh gh api /repos/githubnext/agentics/git/ref/tags/- --jq .object.sha (http block)
  • https://api.github.com/repos/nonexistent/repo/actions/runs/12345
    • Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion js/**/*.json' --git (http block)
    • Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion GOINSECURE GOMOD erignore go estl�� -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/owner/repo/actions/workflows
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } ./../.prettierig/opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo me: String!) { repository(owne-f (http block)
    • Triggering command: /usr/bin/gh gh workflow list --repo owner/repo --json name,path,state 64/pkg/tool/linux_amd64/vet remote.origin.urgit (http block)
  • https://api.github.com/repos/test-owner/test-repo/actions/secrets
    • Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name tags/v6 (http block)
    • Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name pkg/workflow/data/action_pins.json; \ echo "��� Action pins synced successfully"; \ else \ echo "��� Warning: .github/aw/actions-lock.json does not exist yet"; \ fi format:schema 64/bin/go npx prettier --wgo go 64/bin/go sh -c npx prettier --wGOINSECURE go 64/bin/go ath /dev/null GO111MODULE 64/bin/go npm (http block)
    • Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name GOSUMDB GOWORK 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE ache/go/1.25.0/xGOMODCACHE GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/user
    • Triggering command: /usr/bin/gh gh api user --jq .login (http block)
    • Triggering command: /usr/bin/gh gh api user --jq .login js/**/*.json' --ignore-path ../../../.prettierignore (http block)
    • Triggering command: /usr/bin/gh gh api user --jq .login it/ref/tags/v6 (http block)

If you need me to access, download, or install something from one of these locations, you can either:

Original prompt

Remove support for SRT (sandbox runtime).

  • remove from JSON schema
  • create codemod that convert sandbox.agent:srt to sandbox.agent: awf
  • remove from cli version helper agentic workflow

Search for all "srt" instances and remove.


💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.


Changeset

  • Type: patch
  • Description: Remove the deprecated SRT sandbox backend and migrate any sandbox.agent: srt references to sandbox.agent: awf.

Generated by Changeset Generator

Copilot AI and others added 3 commits February 15, 2026 02:03
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copilot AI changed the title [WIP] Remove support for SRT sandbox runtime Remove SRT (Sandbox Runtime) support, keep AWF only Feb 15, 2026
Copilot AI requested a review from pelikhan February 15, 2026 02:18
@pelikhan pelikhan added the smoke label Feb 15, 2026
@github-actions
Copy link
Contributor

📰 BREAKING: Smoke Copilot is now investigating this pull request. Sources say the story is developing...

@github-actions
Copy link
Contributor

🧪 Smoke Temporary ID is now testing temporary ID functionality...

@github-actions
Copy link
Contributor

github-actions bot commented Feb 15, 2026

Smoke Copilot SDK failed. Please review the logs for details.

@github-actions
Copy link
Contributor

🧪 Smoke Project is now testing project operations...

@github-actions
Copy link
Contributor

github-actions bot commented Feb 15, 2026

Changeset Generator completed successfully!

@github-actions
Copy link
Contributor

github-actions bot commented Feb 15, 2026

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

@github-actions
Copy link
Contributor

github-actions bot commented Feb 15, 2026

🎬 THE ENDSmoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨

@github-actions
Copy link
Contributor

Agent Container Tool Check

Tool Status Version
bash 5.2.21
sh available
git 2.52.0
jq 1.7
yq 4.52.2
curl 8.5.0
gh 2.86.0
node 20.20.0
python3 3.12.3
go 1.24.13
java 21.0.10
dotnet 10.0.102

Result: 12/12 tools available ✅

All required development tools are present and functional in the agent container environment.

AI generated by Agent Container Smoke Test

@github-actions
Copy link
Contributor

Smoke Temporary ID completed successfully. Temporary ID validation passed.

@github-actions
Copy link
Contributor

Smoke Project completed successfully. All project operations validated.

@github-actions
Copy link
Contributor

Smoke test results (Codex):
PRs: Fix docs build: invalid link in safe-outputs-specification; Switch review workflows to submit_pull_request_review
GitHub MCP: ✅
Serena MCP: ✅
Playwright: ✅
File write+cat: ✅
Build: ✅
Overall: PASS

AI generated by Smoke Codex

@github-actions
Copy link
Contributor

Smoke Test Results

PRs: #15838, #15834

  1. ✅ GitHub MCP
  2. ✅ Safe Inputs GH CLI
  3. ❌ Serena MCP (not available)
  4. ✅ Playwright
  5. ✅ File Writing
  6. ✅ Bash Tool
  7. ✅ Discussion Interaction
  8. ✅ Build gh-aw
  9. ✅ Discussion Creation
  10. ✅ Workflow Dispatch
  11. ✅ PR Review

Status: PASS (10/11)

cc @pelikhan @Copilot

AI generated by Smoke Copilot

Copy link
Contributor

@github-actions github-actions bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good cleanup removing SRT support. The migration path is clear and all references are properly removed.

📰 BREAKING: Report filed by Smoke Copilot for issue #15834

@@ -31,7 +31,7 @@ timeout-minutes: 45

# CLI Version Checker
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good removal of deprecated SRT references from description

// DefaultSandboxRuntimeVersion is the default version of the @anthropic-ai/sandbox-runtime package (SRT)
const DefaultSandboxRuntimeVersion Version = "0.0.37"

// DefaultPlaywrightMCPVersion is the default version of the @playwright/mcp package
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Clean removal of deprecated constant

@github-actions
Copy link
Contributor

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

Copy link
Contributor

@github-actions github-actions bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💥 Automated smoke test review - all systems nominal!

💥 [THE END] — Illustrated by Smoke Claude for issue #15834

@pelikhan pelikhan marked this pull request as ready for review February 15, 2026 02:42
Copilot AI review requested due to automatic review settings February 15, 2026 02:42
@pelikhan pelikhan merged commit 5f43aa8 into main Feb 15, 2026
2 checks passed
@pelikhan pelikhan deleted the copilot/remove-srt-support branch February 15, 2026 02:42
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This pull request removes support for the Anthropic Sandbox Runtime (SRT) as a sandbox backend, leaving Agent Workflow Firewall (AWF) as the only supported sandbox implementation. The PR includes automatic migration of legacy sandbox.agent: srt references to sandbox.agent: awf through a codemod function.

Changes:

  • Removed SRT-specific code (~700 lines including installation, execution, and wrapper generation)
  • Updated JSON schema to remove "srt" and "sandbox-runtime" enum values
  • Added migrateSRTToAWF() codemod that automatically converts SRT configurations to AWF during workflow parsing
  • Removed SandboxRuntimeFeatureFlag constant and related feature flag validation
  • Renamed copilot_srt.go to copilot_installer.go (kept non-SRT helper functions)
  • Updated CLI version checker workflow to remove Sandbox Runtime monitoring

Reviewed changes

Copilot reviewed 24 out of 24 changed files in this pull request and generated no comments.

Show a summary per file
File Description
pkg/workflow/sandbox.go Added migrateSRTToAWF() codemod, removed SRT type constants, removed JSON and sliceutil imports
pkg/workflow/sandbox_validation.go Removed SRT validation logic, added deprecation error for sandbox.config field
pkg/workflow/sandbox_validation_test.go Removed extensive SRT validation test cases, simplified to AWF-only tests
pkg/workflow/sandbox_test.go Simplified tests to focus on AWF, removed SRT-specific generation tests
pkg/workflow/strict_mode_validation.go Removed SRT/AWF mutual exclusivity check from firewall validation
pkg/workflow/firewall.go Removed SRT detection logic from AWF auto-enablement
pkg/workflow/compiler_safe_outputs.go Removed SRT type checks from isSandboxEnabled()
pkg/workflow/compiler_safe_outputs_test.go Updated test cases to use AWF instead of SRT
pkg/workflow/compiler.go Removed experimental warning for sandbox-runtime feature
pkg/workflow/copilot_engine_installation.go Removed SRT installation paths, simplified to AWF-only logic
pkg/workflow/copilot_engine_execution.go Removed SRT execution paths and wrapper command generation
pkg/workflow/copilot_engine_test.go Updated test to use AWF instead of SRT
pkg/workflow/copilot_srt.go Deleted (255 lines of SRT-specific code)
pkg/workflow/copilot_installer.go Created (79 lines - extracted non-SRT functions from copilot_srt.go)
pkg/workflow/srt_version_pinning_test.go Deleted (88 lines)
pkg/workflow/sandbox_custom_agent_test.go Updated test cases to use AWF instead of SRT
pkg/workflow/sandbox_agent_tools_default_test.go Updated test cases to use AWF instead of SRT
pkg/workflow/firewall_default_enablement_test.go Updated test to use AWF type instead of SRT
pkg/constants/constants.go Removed DefaultSandboxRuntimeVersion and SandboxRuntimeFeatureFlag constants
pkg/constants/constants_test.go Removed SandboxRuntimeFeatureFlag test case
pkg/parser/schemas/main_workflow_schema.json Removed "srt" and "sandbox-runtime" from enum values, updated descriptions
.github/workflows/cli-version-checker.md Removed Sandbox Runtime from monitored tools list
.github/workflows/cli-version-checker.lock.yml Recompiled workflow with updated description
.changeset/patch-remove-srt-support.md Created - documents the change for release notes

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

github-actions bot added a commit that referenced this pull request Feb 15, 2026
Remove Sandbox Runtime (SRT) references and update documentation to reflect
that AWF is now the only supported sandbox implementation. Legacy workflows
using SRT are automatically migrated to AWF during workflow parsing.

Changes:
- Updated introduction to specify AWF only
- Removed SRT configuration examples
- Replaced SRT section with deprecation notice and migration guide
- Updated field tables to remove SRT identifier
- Added migration notes for legacy workflows
- Updated feature flags section to remove sandbox-runtime flag

Related to #15834 (Remove SRT support)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants