api-proxy: --openai-api-base-path / --anthropic-api-base-path implemented in AWF; gh-aw compiler must auto-extract base path fro [Content truncated due to length]

[lpcox]

Problem

When OPENAI_BASE_URL includes a required path prefix (e.g., (host.databricks.com/redacted), the old AWF extractAPITargetHost()stripped the path, sending requests to(host/redacted) instead of `(host/redacted) This caused 404 errors for Databricks, Azure OpenAI deployments, and any corporate LLM router with a path prefix.

Context

Original report: github/gh-aw#21320

AWF firewall side is already implemented (merged in PR #1369):

• src/cli.ts:1355, :1363: --openai-api-base-path <path> and --anthropic-api-base-path <path> CLI flags exist
• src/cli.ts:1731: openaiApiBasePath set from flag or OPENAI_API_BASE_PATH env var
• containers/api-proxy/server.js:77–94, :148, :220, :259: buildUpstreamPath() and basePath parameter in proxyRequest() correctly prepend the base path

The remaining gap is on the gh-aw compiler side: the gh-aw extractAPITargetHost() function still strips the path, and the compiler does not yet call extractAPIBasePath() + --openai-api-base-path when building AWF args.

Root Cause (Residual)

pkg/workflow/awf_helpers.go:315–324 in gh-aw:

if idx := strings.Index(host, "/"); idx != -1 {
    host = host[:idx]
}

This strips the path. The compiler calls BuildAWFArgs() but does not add --openai-api-base-path for the extracted path component.

On the AWF side, all required infrastructure is in place. No AWF code changes are needed to support the feature.

Proposed Solution

AWF side (verification / hardening)

1. Verify end-to-end behaviour: when --openai-api-base-path /serving-endpoints is passed alongside --openai-api-target stone-dataplatform.cloud.databricks.com, confirm that proxyRequest() in containers/api-proxy/server.js prepends /serving-endpoints to the request path (e.g., resulting in /serving-endpoints/v1/chat/completions).

2. Add unit test for buildUpstreamPath() covering:

   • base path /serving-endpoints + req URL /v1/chat/completions → /serving-endpoints/v1/chat/completions
   • base path `` + req URL /v1/chat/completions → `/v1/chat/completions`
   • base path / (edge case) → treated as empty

3. Add integration test in tests/integration/ for the --openai-api-base-path flag verifying the domain allowlist entry is derived from the target host (not the base path), consistent with the pattern in tests/integration/api-target-allowlist.test.ts.

4. Document --openai-api-base-path and --anthropic-api-base-path in README.md with a Databricks example.

gh-aw compiler side (tracked in gh-aw)

Add extractAPIBasePath() and pass --openai-api-base-path / --anthropic-api-base-path in BuildAWFArgs().

Generated by AWF Issue Auditor · ◷