🩺 Runner Doctor Updatenew D7 (gVisor Bun JIT crash), B2 fix (proxy --env override), C8 update (BYOK offline sentinel)

[github-actions]

Summary

• Scan window: 2026-07-15 to 2026-07-16 (UTC)
• Items reviewed: ~20 issues/PRs updated since 2026-07-15
• Genuinely new lessons: 3 (1 new failure mode, 2 updates to existing modes)

---

Proposed knowledge-base changes

File: .github/workflows/shared/self-hosted-failure-modes.md

1. New failure mode D7 — gVisor + Bun/JSC JIT crash

Add after the D6 row in the Category D table:

| D7 | Claude Code (Bun runtime) crashes with SIGSEGV / SIGABRT under --container-runtime gvisor; the harness retries multiple times, each attempt failing with exit code 1; no output or minimal output is produced | gVisor restricts the W^X (write XOR execute) memory operations required by JIT compilers. Bun uses JavaScriptCore (JSC) with JIT enabled by default; JSC generates native code via JIT, triggering SIGSEGV/SIGABRT on gVisor's restricted syscall surface | Pass --env BUN_JSC_useJIT=0 to AWF (or set it as a job-level env var with --env-all) to force JSC into interpreter mode inside the gVisor sandbox; a postprocess-smoke-workflows.ts hook auto-injects the flag for smoke-gvisor-claude workflows on recompile | Inside the AWF gVisor agent container: echo $BUN_JSC_useJIT should be 0; a crash without this flag confirms the mode via SIGSEGV/SIGABRT signal in agent logs | #6260, #6261 |

Also add to Error-string quick lookup:

| SIGSEGV / SIGABRT signal crash with Claude Code (Bun runtime) under --container-runtime gvisor; retries all fail | D7 |

2. Update B2 — proxy --env override regression

Update the B2 row Fix column to add:

Note: AWF ≤ v0.27.32 (before PR #6267) silently blocked proxy environment variables (NO_PROXY, HTTP_PROXY, HTTPS_PROXY, etc.) when passed via --env if enableApiProxy is active, because PROXY_ENV_VARS were in the credential exclusion set. Fixed in PR #6267: proxy vars are now checked against the PROXY_ENV_VARS allowlist and passed through additionalEnv even when credential isolation is active.

Add github/gh-aw-firewall#6267 to the B2 citations.

3. Update C8 — residual 400 with offline BYOK sentinel on GHEC

Update the C8 row to note a second fix:

In the Signal column, add: ; or 400persists even after upgrading past #5872 whenCOPILOT_PROVIDER_API_KEY=dummy-byok-key-for-offline-modeis set bygh-aw offline mode

In the Fix column, add:

Additional fix (PR #6237): gh-aw's offline mode sets COPILOT_PROVIDER_API_KEY=dummy-byok-key-for-offline-mode as a sentinel. In AWF before #6237, this sentinel was treated as a real BYOK key, suppressing the GitHub-token auth path and producing 400 on Business/Enterprise targets. Fixed by treating dummy-byok-key-for-offline-mode as a non-credential sentinel (same class as AWF placeholder tokens).

Add github/gh-aw-firewall#6237 to the C8 citations.

---

Proposed doctor changes

File: .github/workflows/self-hosted-runner-doctor.md

No playbook changes needed. The error-string lookup addition (D7 Bun/JSC gVisor crash) should be added in the appropriate section.

---

Proposed portable agent changes

File: .github/agents/self-hosted-runner-doctor.md

The portable agent embeds the same failure-mode catalog. Apply all three changes above identically:

1. Add D7 row to the Category D table (after D6)
2. Add D7 error-string lookup entry to the quick-lookup table
3. Update B2 Fix column to mention the --env proxy override regression fixed in fix: allow --env proxy overrides + move net isolation check into AWF container #6267
4. Update C8 Fix column and citations to reference the offline BYOK sentinel fix in Handle gh-aw offline BYOK sentinel in Copilot auth selection for Business/Enterprise targets #6237

---

Source issues and PRs

• Claude Code crashes with SIGSEGV/SIGABRT under gVisor due to Bun JIT compilation #6260 — Issue: "Claude Code crashes with SIGSEGV/SIGABRT under gVisor due to Bun JIT compilation" (closed 2026-07-16)
• fix: disable Bun JIT in smoke-gvisor-claude to prevent SIGSEGV/SIGABRT #6261 — PR: "fix: disable Bun JIT in smoke-gvisor-claude to prevent SIGSEGV/SIGABRT" (merged 2026-07-15)
• fix: allow --env proxy overrides + move net isolation check into AWF container #6267 — PR: "fix: allow --env proxy overrides + move net isolation check into AWF container" (merged 2026-07-15); Problem 1 (proxy --env blocked) is the relevant part
• Handle gh-aw offline BYOK sentinel in Copilot auth selection for Business/Enterprise targets #6237 — PR: "Handle gh-aw offline BYOK sentinel in Copilot auth selection for Business/Enterprise targets" (merged 2026-07-15)

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by Runner Doctor Updater · 152.7 AIC · ⊞ 15K · ◷

• expires on Aug 15, 2026, 7:24 PM UTC