From 327c88252a0ffeb2f7f4ce991b7e2bac40b4b325 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 19 Feb 2026 01:28:26 +0000
Subject: [PATCH 1/2] Initial plan
From 0085e83caa68958bbbaa1e73187426b17600bba7 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 19 Feb 2026 01:33:26 +0000
Subject: [PATCH 2/2] fix: set JAVA_TOOL_OPTIONS and generate Maven
settings.xml for JVM proxy
Co-authored-by: Mossaka <5447827+Mossaka@users.noreply.github.com>
---
.github/workflows/build-test-java.md | 19 +--------------
containers/agent/entrypoint.sh | 33 +++++++++++++++++++++++++
docs/troubleshooting.md | 36 ++++++----------------------
src/docker-manager.test.ts | 13 ++++++++++
src/docker-manager.ts | 4 ++++
5 files changed, 58 insertions(+), 47 deletions(-)
diff --git a/.github/workflows/build-test-java.md b/.github/workflows/build-test-java.md
index eaabad46..006cb310 100644
--- a/.github/workflows/build-test-java.md
+++ b/.github/workflows/build-test-java.md
@@ -50,24 +50,7 @@ Clone and test the following projects from the test repository:
1. **Clone Repository**: `gh repo clone Mossaka/gh-aw-firewall-test-java /tmp/test-java`
- **CRITICAL**: If clone fails, immediately call `safeoutputs-missing_tool` with message "CLONE_FAILED: Unable to clone test repository" and stop execution
-2. **Configure Maven Proxy**: Maven ignores Java system properties for proxy configuration, so you must create `~/.m2/settings.xml` before running any Maven commands. **IMPORTANT**: Use the literal values `squid-proxy` and `3128` directly in the XML - do NOT use shell variables or environment variable syntax:
- ```bash
- mkdir -p ~/.m2
- cat > ~/.m2/settings.xml << 'SETTINGS'
-
-
-
- awf-httptruehttp
- squid-proxy3128
-
-
- awf-httpstruehttps
- squid-proxy3128
-
-
-
- SETTINGS
- ```
+2. **Maven Proxy**: Maven proxy configuration (`~/.m2/settings.xml`) is automatically generated by AWF's agent container entrypoint. No manual setup is needed.
3. **Test Projects**:
- `gson`: `cd /tmp/test-java/gson && mvn compile && mvn test`
diff --git a/containers/agent/entrypoint.sh b/containers/agent/entrypoint.sh
index 4f8170c8..609edba0 100644
--- a/containers/agent/entrypoint.sh
+++ b/containers/agent/entrypoint.sh
@@ -167,6 +167,39 @@ echo "[entrypoint] Proxy configuration:"
echo "[entrypoint] HTTP_PROXY=$HTTP_PROXY"
echo "[entrypoint] HTTPS_PROXY=$HTTPS_PROXY"
+# Generate Maven settings.xml with proxy configuration
+# Maven ignores JAVA_TOOL_OPTIONS and HTTP_PROXY; it requires ~/.m2/settings.xml
+if [ -n "$SQUID_PROXY_HOST" ] && [ -n "$SQUID_PROXY_PORT" ]; then
+ MAVEN_DIR="$(eval echo ~awfuser)/.m2"
+ if [ ! -f "$MAVEN_DIR/settings.xml" ]; then
+ mkdir -p "$MAVEN_DIR"
+ cat > "$MAVEN_DIR/settings.xml" << MAVEN_SETTINGS
+
+
+
+ awf-http
+ true
+ http
+ ${SQUID_PROXY_HOST}
+ ${SQUID_PROXY_PORT}
+
+
+ awf-https
+ true
+ https
+ ${SQUID_PROXY_HOST}
+ ${SQUID_PROXY_PORT}
+
+
+
+MAVEN_SETTINGS
+ chown awfuser:awfuser "$MAVEN_DIR" "$MAVEN_DIR/settings.xml"
+ echo "[entrypoint] ✓ Generated Maven settings.xml with proxy configuration"
+ else
+ echo "[entrypoint] Maven settings.xml already exists, skipping generation"
+ fi
+fi
+
# Print network information
echo "[entrypoint] Network information:"
echo "[entrypoint] IP address: $(hostname -I)"
diff --git a/docs/troubleshooting.md b/docs/troubleshooting.md
index 93a8dd1d..862ceebb 100644
--- a/docs/troubleshooting.md
+++ b/docs/troubleshooting.md
@@ -161,39 +161,17 @@
AWF automatically sets `JAVA_TOOL_OPTIONS` with `-Dhttp.proxyHost`, `-Dhttp.proxyPort`, `-Dhttps.proxyHost`, `-Dhttps.proxyPort`, and `-Dhttp.nonProxyHosts` inside the agent container. This works for most Java tools that read standard JVM system properties, including Gradle and SBT.
-### Maven Requires Extra Configuration
+AWF also automatically generates `~/.m2/settings.xml` with proxy configuration in the agent container entrypoint. This ensures Maven builds work out of the box without manual configuration.
-**Problem:** Maven builds fail with network errors even though the domain is in `--allow-domains`
-
-**Cause:** Maven's HTTP transport (Apache HttpClient / Maven Resolver) ignores Java system properties for proxy configuration. Unlike Gradle and most other Java tools, Maven does **not** read `-DproxyHost`/`-DproxyPort` from `JAVA_TOOL_OPTIONS`.
-
-**Solution:** Create `~/.m2/settings.xml` with proxy configuration before running Maven:
-
-```bash
-mkdir -p ~/.m2
-cat > ~/.m2/settings.xml << EOF
-
-
-
- awf-httptruehttp
- ${SQUID_PROXY_HOST}${SQUID_PROXY_PORT}
-
-
- awf-httpstruehttps
- ${SQUID_PROXY_HOST}${SQUID_PROXY_PORT}
-
-
-
-EOF
-```
+### Gradle Works Automatically
-The `SQUID_PROXY_HOST` and `SQUID_PROXY_PORT` environment variables are automatically set by AWF in the agent container.
+Gradle reads JVM system properties via `ProxySelector.getDefault()`, so the `JAVA_TOOL_OPTIONS` environment variable set by AWF is sufficient. No extra configuration is needed for Gradle builds.
-For agentic workflows, add this as a setup step in the workflow `.md` file so the agent creates the file before running Maven commands.
+### Maven Works Automatically
-### Gradle Works Automatically
+Maven's HTTP transport (Apache HttpClient / Maven Resolver) ignores `JAVA_TOOL_OPTIONS` for proxy configuration. AWF handles this by automatically generating `~/.m2/settings.xml` with proxy settings in the agent container entrypoint. No manual configuration is needed.
-Gradle reads JVM system properties via `ProxySelector.getDefault()`, so the `JAVA_TOOL_OPTIONS` environment variable set by AWF is sufficient. No extra configuration is needed for Gradle builds.
+If you need to override the auto-generated `settings.xml` (e.g., to add custom repositories or mirrors), create your own `~/.m2/settings.xml` before running Maven — the entrypoint will not overwrite an existing file if one is bind-mounted.
### Why This Is Needed
@@ -201,7 +179,7 @@ AWF uses a forward proxy (Squid) for HTTPS egress control rather than transparen
- **Most tools**: Use `HTTP_PROXY`/`HTTPS_PROXY` environment variables (set automatically by AWF)
- **Java tools**: Use `JAVA_TOOL_OPTIONS` with JVM system properties (set automatically by AWF)
-- **Maven**: Requires `~/.m2/settings.xml` (must be configured manually — see above)
+- **Maven**: Uses `~/.m2/settings.xml` (generated automatically by AWF)
## Log Analysis
diff --git a/src/docker-manager.test.ts b/src/docker-manager.test.ts
index fad43378..71fcc2f5 100644
--- a/src/docker-manager.test.ts
+++ b/src/docker-manager.test.ts
@@ -494,6 +494,19 @@ describe('docker-manager', () => {
expect(env.SQUID_PROXY_PORT).toBe('3128');
});
+ it('should set JAVA_TOOL_OPTIONS with JVM proxy properties', () => {
+ const result = generateDockerCompose(mockConfig, mockNetworkConfig);
+ const agent = result.services.agent;
+ const env = agent.environment as Record;
+
+ expect(env.JAVA_TOOL_OPTIONS).toBeDefined();
+ expect(env.JAVA_TOOL_OPTIONS).toContain('-Dhttp.proxyHost=squid-proxy');
+ expect(env.JAVA_TOOL_OPTIONS).toContain('-Dhttp.proxyPort=3128');
+ expect(env.JAVA_TOOL_OPTIONS).toContain('-Dhttps.proxyHost=squid-proxy');
+ expect(env.JAVA_TOOL_OPTIONS).toContain('-Dhttps.proxyPort=3128');
+ expect(env.JAVA_TOOL_OPTIONS).toContain('-Dhttp.nonProxyHosts=localhost|127.0.0.1');
+ });
+
it('should mount required volumes in agent container (default behavior)', () => {
const result = generateDockerCompose(mockConfig, mockNetworkConfig);
const agent = result.services.agent;
diff --git a/src/docker-manager.ts b/src/docker-manager.ts
index 299b4128..f42ed119 100644
--- a/src/docker-manager.ts
+++ b/src/docker-manager.ts
@@ -345,6 +345,10 @@ export function generateDockerCompose(
HTTPS_PROXY: `http://${networkConfig.squidIp}:${SQUID_PORT}`,
SQUID_PROXY_HOST: 'squid-proxy',
SQUID_PROXY_PORT: SQUID_PORT.toString(),
+ // JVM proxy configuration: Java ignores HTTP_PROXY/HTTPS_PROXY and requires
+ // system properties via JAVA_TOOL_OPTIONS. Works for Gradle, SBT, and most JVM tools.
+ // Maven requires separate ~/.m2/settings.xml (generated by entrypoint.sh).
+ JAVA_TOOL_OPTIONS: `-Dhttp.proxyHost=squid-proxy -Dhttp.proxyPort=${SQUID_PORT} -Dhttps.proxyHost=squid-proxy -Dhttps.proxyPort=${SQUID_PORT} -Dhttp.nonProxyHosts=localhost|127.0.0.1`,
HOME: homeDir,
PATH: '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin',
// Configure one-shot-token library with sensitive tokens to protect