feat(policy): add GitHub Copilot API endpoints to base sandbox policy (#60)

* feat(policy): add missing Copilot API endpoints to base sandbox policy

The existing copilot policy was missing endpoints needed for Copilot CLI
to function inside OpenShell sandboxes. This adds:

- api.individual/business.githubcopilot.com (subscription-tier routing)
- origin-tracker.githubusercontent.com (tracking)
- telemetry.enterprise.githubcopilot.com (telemetry)
- L7 inspection config (protocol: rest, tls: terminate) on API endpoints
  for proxy-based credential injection support
- Additional binary paths (/usr/bin/node, /usr/bin/copilot, node_modules)

Also adds copilot/node binary paths to github_rest_api and
github_ssh_over_https policies so Copilot can access GitHub API and git.

Tested end-to-end in a live OpenShell sandbox with proxy-based
credential injection. All auth formats verified working.

* chore: bump @github/copilot to 1.0.16 in base sandbox

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: OpenClaw Agent <openclaw@htekdev.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: 3 people

sandboxes/base/Dockerfile

@@ -75,7 +75,7 @@ RUN npm install -g \
         @hono/node-server@1.19.11 \
         opencode-ai@1.2.18 \
         @openai/codex@0.117.0 \
-        @github/copilot@1.0.9
+        @github/copilot@1.0.16
 
 # GitHub CLI
 RUN curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg \

sandboxes/base/policy.yaml

@@ -95,6 +95,30 @@ network_policies:
       - { path: /usr/local/bin/claude }
       - { path: /usr/bin/gh }
 
+  # --- GitHub Copilot API ---
+  # Endpoints from https://docs.github.com/en/copilot/reference/copilot-allowlist-reference
+  copilot:
+    name: copilot
+    endpoints:
+      # Auth and user management
+      - { host: github.com, port: 443 }
+      - { host: api.github.com, port: 443 }
+      # Copilot API (subscription-tier routing)
+      - { host: api.githubcopilot.com, port: 443, protocol: rest, enforcement: enforce, access: read-write }
+      - { host: api.individual.githubcopilot.com, port: 443, protocol: rest, enforcement: enforce, access: read-write }
+      - { host: api.business.githubcopilot.com, port: 443, protocol: rest, enforcement: enforce, access: read-write }
+      - { host: api.enterprise.githubcopilot.com, port: 443, protocol: rest, enforcement: enforce, access: read-write }
+      # Model proxy
+      - { host: copilot-proxy.githubusercontent.com, port: 443, protocol: rest, enforcement: enforce, access: read-write }
+      # Telemetry, feature flags, updates
+      - { host: origin-tracker.githubusercontent.com, port: 443 }
+      - { host: telemetry.enterprise.githubcopilot.com, port: 443 }
+      - { host: default.exp-tas.com, port: 443 }
+      - { host: release-assets.githubusercontent.com, port: 443 }
+    binaries:
+      - { path: /usr/bin/copilot }
+      - { path: "/usr/lib/node_modules/@github/copilot/node_modules/@github/**/copilot" }
+
   pypi:
     name: pypi
     endpoints:
@@ -160,19 +184,6 @@ network_policies:
     - path: /usr/bin/node
     - path: /usr/local/bin/opencode
 
-  copilot:
-    name: copilot
-    endpoints:
-    - { host: github.com, port: 443 }
-    - { host: api.github.com, port: 443 }
-    - { host: api.githubcopilot.com, port: 443 }
-    - { host: api.enterprise.githubcopilot.com, port: 443 }
-    - { host: release-assets.githubusercontent.com, port: 443 }
-    - { host: copilot-proxy.githubusercontent.com, port: 443 }
-    - { host: default.exp-tas.com, port: 443 }
-    binaries:
-    - { path: /usr/lib/node_modules/@github/copilot/node_modules/@github/**/copilot }
-
   codex:
     name: codex
     endpoints: