[awf] Support Azure Copilot BYOK env routing in api-proxy and resolve gpt-5.4 via gpt-5 family aliases (#3241)

* Initial plan

* fix: support azure byok envs in api-proxy

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>

Author: Copilot

containers/api-proxy/model-resolver.js

@@ -133,7 +133,20 @@ function resolveModel(requestedModel, aliases, availableModels, currentProvider,
   const newChain = [...chain, key];
 
   // ── Find alias entry (case-insensitive) ───────────────────────────────────
-  const aliasEntry = Object.entries(aliases).find(([k]) => k.toLowerCase() === key);
+  let aliasEntry = Object.entries(aliases).find(([k]) => k.toLowerCase() === key);
+
+  if (!aliasEntry) {
+    // Family fallback: treat gpt-5.<minor> as gpt-5 when only the family alias
+    // exists. This keeps versioned IDs like gpt-5.4 compatible with configs that
+    // define "gpt-5" alias patterns.
+    const familyAlias = key.match(/^(gpt-5)\.\d+(?:[._-].*)?$/)?.[1];
+    if (familyAlias) {
+      aliasEntry = Object.entries(aliases).find(([k]) => k.toLowerCase() === familyAlias);
+      if (aliasEntry) {
+        log.push(`[model-resolver] fallback alias: "${requestedModel}" → "${aliasEntry[0]}"`);
+      }
+    }
+  }
 
   if (!aliasEntry) {
     // No alias defined — check if the model directly matches an available model for

containers/api-proxy/model-resolver.test.js

@@ -221,6 +221,17 @@ describe('resolveModel', () => {
     expect(result.resolvedModel).toBe('claude-sonnet-4.6');
   });
 
+  it('should resolve gpt-5 minor-version aliases via gpt-5 family fallback', () => {
+    const result = resolveModel(
+      'gpt-5.4',
+      { 'gpt-5': ['copilot/gpt-5*'] },
+      { copilot: ['gpt-5.3', 'gpt-5.4'] },
+      'copilot'
+    );
+    expect(result).not.toBeNull();
+    expect(result.resolvedModel).toBe('gpt-5.4');
+  });
+
   it('should not match provider patterns for a different provider', () => {
     // "gpt-5-codex" only has copilot/... and openai/... patterns
     // When resolving for anthropic, there's nothing to match

containers/api-proxy/oidc-token-provider.test.js

@@ -287,6 +287,36 @@ describe('OpenAI adapter with OIDC', () => {
     expect(adapter.getReflectionInfo().auth_type).toBe('static-key');
   });
 
+  it('should configure OpenAI adapter from Copilot Azure BYOK env vars', () => {
+    const adapter = createOpenAIAdapter({
+      COPILOT_PROVIDER_TYPE: 'azure',
+      COPILOT_PROVIDER_BASE_URL: 'https://my-resource.openai.azure.com/openai/deployments/gpt-5',
+      COPILOT_PROVIDER_API_KEY: 'azure-byok-key',
+    });
+
+    expect(adapter.isEnabled()).toBe(true);
+    expect(adapter.getTargetHost()).toBe('my-resource.openai.azure.com');
+    expect(adapter.getBasePath()).toBe('/openai/deployments/gpt-5');
+    expect(adapter.getAuthHeaders()).toEqual({ Authorization: 'Bearer azure-byok-key' });
+    expect(adapter.getReflectionInfo().auth_type).toBe('static-key');
+  });
+
+  it('should prefer explicit OPENAI_* config over Copilot Azure BYOK env vars', () => {
+    const adapter = createOpenAIAdapter({
+      OPENAI_API_KEY: 'sk-openai',
+      OPENAI_API_TARGET: 'gateway.example.com',
+      OPENAI_API_BASE_PATH: '/v2',
+      COPILOT_PROVIDER_TYPE: 'azure',
+      COPILOT_PROVIDER_BASE_URL: 'https://my-resource.openai.azure.com/openai/deployments/gpt-5',
+      COPILOT_PROVIDER_API_KEY: 'azure-byok-key',
+    });
+
+    expect(adapter.isEnabled()).toBe(true);
+    expect(adapter.getTargetHost()).toBe('gateway.example.com');
+    expect(adapter.getBasePath()).toBe('/v2');
+    expect(adapter.getAuthHeaders()).toEqual({ Authorization: 'Bearer sk-openai' });
+  });
+
   it('should not create OIDC provider when required vars are missing', () => {
     const adapter = createOpenAIAdapter({
       AWF_AUTH_TYPE: 'github-oidc',

containers/api-proxy/providers/openai.js

@@ -10,9 +10,32 @@
  * Base path: OPENAI_API_BASE_PATH  (default: /v1 for the public endpoint)
  */
 
-const { createBaseAdapterConfig, createAdapterMethods } = require('../proxy-utils');
+const {
+  createBaseAdapterConfig,
+  createAdapterMethods,
+  normalizeBasePath,
+} = require('../proxy-utils');
 const { OidcTokenProvider } = require('../oidc-token-provider');
 
+function parseByokBaseUrl(baseUrl) {
+  if (!baseUrl) return { target: undefined, basePath: '' };
+  const trimmed = baseUrl.trim();
+  if (!trimmed) return { target: undefined, basePath: '' };
+
+  const candidate = /^[a-zA-Z][a-zA-Z\d+\-.]*:\/\//.test(trimmed)
+    ? trimmed
+    : `https://${trimmed}`;
+  try {
+    const parsed = new URL(candidate);
+    return {
+      target: parsed.hostname || undefined,
+      basePath: normalizeBasePath(parsed.pathname),
+    };
+  } catch {
+    return { target: undefined, basePath: '' };
+  }
+}
+
 /**
  * Create the OpenAI provider adapter.
  *
@@ -21,12 +44,21 @@ const { OidcTokenProvider } = require('../oidc-token-provider');
  * @returns {import('./index').ProviderAdapter}
  */
 function createOpenAIAdapter(env, deps = {}) {
-  const { apiKey, rawTarget, basePath: explicitBasePath } = createBaseAdapterConfig(env, {
+  const { apiKey: openaiApiKey, rawTarget: openaiTarget, basePath: openaiBasePath } = createBaseAdapterConfig(env, {
     keyEnvVar: 'OPENAI_API_KEY',
     targetEnvVar: 'OPENAI_API_TARGET',
     basePathEnvVar: 'OPENAI_API_BASE_PATH',
     defaultTarget: 'api.openai.com',
   });
+  const providerType = (env.COPILOT_PROVIDER_TYPE || '').trim().toLowerCase();
+  const copilotAzureByokEnabled = providerType === 'azure';
+  const copilotByokApiKey = (env.COPILOT_PROVIDER_API_KEY || '').trim() || undefined;
+  const { target: copilotByokTarget, basePath: copilotByokBasePath } = parseByokBaseUrl(env.COPILOT_PROVIDER_BASE_URL);
+
+  const apiKey = openaiApiKey || (copilotAzureByokEnabled ? copilotByokApiKey : undefined);
+  const explicitOpenAITarget = env.OPENAI_API_TARGET ? openaiTarget : undefined;
+  const rawTarget = explicitOpenAITarget || (copilotAzureByokEnabled ? copilotByokTarget : undefined) || 'api.openai.com';
+  const explicitBasePath = openaiBasePath || (copilotAzureByokEnabled ? copilotByokBasePath : '');
 
   // For the default OpenAI endpoint, unversioned clients (e.g. Codex CLI sending
   // /responses) need a /v1 prefix to reach the correct versioned API surface.
@@ -175,7 +207,7 @@ function createOpenAIAdapter(env, deps = {}) {
       }
       return {
         statusCode: 404,
-        body: { error: 'OpenAI proxy not configured (no OPENAI_API_KEY or OIDC auth)' },
+        body: { error: 'OpenAI proxy not configured (no OPENAI_API_KEY/COPILOT_PROVIDER_API_KEY or OIDC auth)' },
       };
     },
   };

src/services/api-proxy-service.test.ts

@@ -900,6 +900,44 @@ describe('API proxy sidecar', () => {
         expect(env.COPILOT_PROVIDER_BASE_URL).toBeUndefined();
       });
 
+      it('should pass COPILOT_PROVIDER_TYPE/BASE_URL/API_KEY from additionalEnv to api-proxy', () => {
+        const configWithProxy = {
+          ...mockConfig,
+          enableApiProxy: true,
+          additionalEnv: {
+            COPILOT_PROVIDER_TYPE: 'azure',
+            COPILOT_PROVIDER_BASE_URL: 'https://example-resource.openai.azure.com/openai/deployments/test',
+            COPILOT_PROVIDER_API_KEY: 'azure-byok-key',
+          },
+        };
+        const result = generateDockerCompose(configWithProxy, mockNetworkConfigWithProxy);
+        const proxy = result.services['api-proxy'];
+        const env = proxy.environment as Record<string, string>;
+        expect(env.COPILOT_PROVIDER_TYPE).toBe('azure');
+        expect(env.COPILOT_PROVIDER_BASE_URL).toBe('https://example-resource.openai.azure.com/openai/deployments/test');
+        expect(env.COPILOT_PROVIDER_API_KEY).toBe('azure-byok-key');
+      });
+
+      it('should pass COPILOT_PROVIDER_TYPE/BASE_URL/API_KEY from envFile to api-proxy', () => {
+        const envFilePath = path.join(mockConfig.workDir, '.env.azure-byok');
+        fs.writeFileSync(envFilePath, [
+          'COPILOT_PROVIDER_TYPE=azure',
+          'COPILOT_PROVIDER_BASE_URL=https://example-resource.openai.azure.com/openai/deployments/test',
+          'COPILOT_PROVIDER_API_KEY=azure-byok-key',
+        ].join('\n'));
+        const configWithProxy = {
+          ...mockConfig,
+          enableApiProxy: true,
+          envFile: envFilePath,
+        };
+        const result = generateDockerCompose(configWithProxy, mockNetworkConfigWithProxy);
+        const proxy = result.services['api-proxy'];
+        const env = proxy.environment as Record<string, string>;
+        expect(env.COPILOT_PROVIDER_TYPE).toBe('azure');
+        expect(env.COPILOT_PROVIDER_BASE_URL).toBe('https://example-resource.openai.azure.com/openai/deployments/test');
+        expect(env.COPILOT_PROVIDER_API_KEY).toBe('azure-byok-key');
+      });
+
       it.each(['gpt-5', 'openai/o3-mini', 'gpt-5.4-mini', 'GPT-5', 'O3'])('should set COPILOT_PROVIDER_WIRE_API=responses in GitHub token mode when COPILOT_MODEL is %s', (copilotModel) => {
         const configWithProxy = {
           ...mockConfig,

src/services/api-proxy-service.ts

@@ -47,6 +47,18 @@ function getCopilotModel(config: WrapperConfig): string | undefined {
   return normalizedModel || undefined;
 }
 
+function getConfigEnvValue(config: WrapperConfig, key: string): string | undefined {
+  const envFileValue = config.envFile
+    ? readEnvFile(config.envFile)[key]
+    : undefined;
+  const value =
+    config.additionalEnv?.[key] ??
+    envFileValue ??
+    (config.envAll ? process.env[key] : undefined);
+  const normalizedValue = value?.trim();
+  return normalizedValue || undefined;
+}
+
 function requiresResponsesWireApi(copilotModel: string): boolean {
   return RESPONSES_WIRE_API_MODEL_PATTERN.test(copilotModel);
 }
@@ -59,6 +71,9 @@ export function buildApiProxyService(params: ApiProxyServiceParams): ApiProxyBui
   const { config, networkConfig, apiProxyLogsPath, imageConfig } = params;
   const { useGHCR, registry, parsedTag, projectRoot } = imageConfig;
   const normalizedAuthType = (process.env.AWF_AUTH_TYPE || '').trim().toLowerCase();
+  const copilotProviderType = getConfigEnvValue(config, 'COPILOT_PROVIDER_TYPE');
+  const copilotProviderBaseUrl = getConfigEnvValue(config, 'COPILOT_PROVIDER_BASE_URL');
+  const copilotProviderApiKey = getConfigEnvValue(config, 'COPILOT_PROVIDER_API_KEY');
 
   if (!networkConfig.proxyIp) {
     throw new Error('buildApiProxyService: networkConfig.proxyIp is required');
@@ -91,6 +106,9 @@ export function buildApiProxyService(params: ApiProxyServiceParams): ApiProxyBui
       // container at all (belt-and-suspenders for gh-aw#25137).
       ...(config.copilotApiTarget && { COPILOT_API_TARGET: stripScheme(config.copilotApiTarget) }),
       ...(config.copilotApiBasePath && { COPILOT_API_BASE_PATH: config.copilotApiBasePath }),
+      ...(copilotProviderType && { COPILOT_PROVIDER_TYPE: copilotProviderType }),
+      ...(copilotProviderBaseUrl && { COPILOT_PROVIDER_BASE_URL: copilotProviderBaseUrl }),
+      ...(copilotProviderApiKey && { COPILOT_PROVIDER_API_KEY: copilotProviderApiKey }),
       ...(config.openaiApiTarget && { OPENAI_API_TARGET: stripScheme(config.openaiApiTarget) }),
       ...(config.openaiApiBasePath && { OPENAI_API_BASE_PATH: config.openaiApiBasePath }),
       ...(config.anthropicApiTarget && { ANTHROPIC_API_TARGET: stripScheme(config.anthropicApiTarget) }),