[awf] api-proxy: add --anthropic-api-auth-header / --openai-api-auth-header flags for custom upstream auth headers

[lpcox]

Problem

The AWF api-proxy sidecar hard-codes auth header names when forwarding to upstream providers (x-api-key for Anthropic, Authorization: Bearer for OpenAI). Internal AI gateways that require a different header name (e.g. api-key:) cannot be used, causing pre-flight /v1/models to return 403 and the run to fail before the agent starts.

Context

Upstream report: github/gh-aw#35192

Reflect logs from affected runs:

awf-reflect: models fetch returned 403 for (apiproxy/redacted)
Failed to authenticate. API Error: ERROR: The requested URL could not be retrieved

The gh-aw compiler must emit a new --anthropic-api-auth-header / --openai-api-auth-header flag to the AWF invocation in the compiled lock file when engine.authHeader is configured.

Root Cause

containers/api-proxy/ Anthropic and OpenAI adapters have the auth header names hardcoded. There is no CLI flag to override them, and src/docker-manager.ts does not pass any such flag to the sidecar container.

Proposed Solution

1. In containers/api-proxy/, parse new --anthropic-api-auth-header <name> and --openai-api-auth-header <name> startup flags. When set, use the provided header name instead of the default.
2. Update the pre-flight /v1/models check to use the same overridden header.
3. In src/docker-manager.ts, plumb a new WrapperConfig field (e.g. anthropicApiAuthHeader, openaiApiAuthHeader) through to the sidecar container's command arguments.
4. Default behavior (flag absent) must be unchanged to preserve backward compatibility.

Generated by Firewall Issue Dispatcher · sonnet46 2.5M · ◷