Share enclave gateway readiness response handling

[Copilot]

Both enclave gateway implementations duplicated readiness-response buffering, framing-limit enforcement, and HTTP status validation, creating drift risk on a security-critical path.

• Shared helper
  • Added readGatewayReadinessResponse(...) for bounded buffering and accepted-status validation.
• Gateway integration
  • Updated standard and GitHub gateway clients to use the helper.
  • Preserved gateway-specific error types, messages, status codes, and retry handling.

readGatewayReadinessResponse(response, request, errorFactory, 256 * 1024);

• Fixes [Duplicate Code] Shared gateway readiness framing logic #10039

[Copilot]

🔵 Needs a closer look

Security-sensitive stream-handling changes need human validation of uncovered GitHub gateway failure paths.

1 open finding

• Add GitHub gateway coverage for response and retry edge cases · New

What changed in this PR

Consolidates readiness-response handling for AWF’s enclave gateways, reducing duplication on a security-sensitive path.

Changes:

• Adds shared response buffering, size-limit enforcement, and HTTP status validation.
• Integrates both gateways while retaining their error construction and retry policies.

File	Description
src/​enclave/​github-gateway.ts	Uses the shared reader for GitHub gateway responses.
src/​enclave/​gateway.ts	Uses the shared reader for standard gateway responses.
src/​enclave/​gateway-readiness.ts	Implements bounded buffering and accepted-status validation.

🧠 Review effort: Max

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Added the requested GitHub-gateway response and retry cases, including prompt rejection of interrupted bodies. Commit: 01e22cc.

[lpcox]

@copilot Fix the code for all comments in this review thread.

When a review comment includes a suggested change, apply the suggestion exactly.

Do not make changes beyond what is described in the linked review thread.

[Copilot]

@copilot Fix the code for all comments in this review thread.

When a review comment includes a suggested change, ap...

Addressed the linked review thread with the requested GitHub-gateway tests. Commit: 01e22cc.

[github-actions]

⏳ Copilot review left inline comments.

@copilot To proceed:

1. Ask @copilot to address the review feedback (reply to this comment or the review thread)
2. Once the fix is pushed, add the ready-for-aw label to trigger agentic CI smoke tests

[github-actions]

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	93.18%	93.27%	📈 +0.09%
Statements	91.76%	91.86%	📈 +0.10%
Functions	90.68%	90.74%	📈 +0.06%
Branches	85.62%	85.72%	📈 +0.10%

📁 Per-file Coverage Changes (13 files)

File	Lines (Before → After)	Statements (Before → After)
src/nvx/cleanup-store.ts	70.6% → 69.1% (-1.45%)	65.6% → 64.0% (-1.55%)
src/cloud-hypervisor/cleanup-record-store.ts	97.9% → 97.8% (-0.07%)	94.6% → 94.4% (-0.17%)
src/cloud-hypervisor/diagnostics.ts	88.4% → 88.4% (+0.00%)	86.9% → 87.3% (+0.42%)
src/cloud-hypervisor/host-preflight-progress.ts	100.0% → 100.0% (+0.00%)	96.2% → 96.3% (+0.09%)
src/enclave/gateway.ts	100.0% → 100.0% (+0.00%)	99.6% → 99.6% (-0.02%)
src/cloud-hypervisor/host-enclave-executor.ts	94.6% → 94.6% (+0.02%)	91.0% → 91.0% (+0.03%)
src/cloud-hypervisor/manager.ts	90.2% → 90.6% (+0.46%)	88.8% → 89.4% (+0.63%)
src/cloud-hypervisor/artifact-manifest.ts	87.3% → 88.5% (+1.22%)	87.3% → 88.5% (+1.22%)
src/nvx/outcome.ts	84.0% → 85.4% (+1.41%)	84.3% → 85.7% (+1.40%)
src/cloud-hypervisor/manager-start.ts	86.3% → 88.5% (+2.22%)	85.8% → 89.9% (+4.03%)
src/log-directory-setup.ts	96.8% → 100.0% (+3.18%)	96.9% → 100.0% (+3.13%)
src/cloud-hypervisor/manager-stop.ts	92.5% → 95.7% (+3.22%)	86.8% → 90.9% (+4.13%)
src/enclave/github-gateway.ts	82.6% → 87.1% (+4.53%)	79.8% → 84.4% (+4.62%)

✨ New Files (3 files)

• src/json-validation.ts: 100.0% lines
• src/private-file.ts: 100.0% lines
• src/enclave/gateway-readiness.ts: 100.0% lines

---

Coverage comparison generated by scripts/ci/compare-coverage.ts