[windows-grower] Run Windows agent runtime setup inside WSL before pulling Linux images #70220

Summary

The Windows probe pulls Linux-only agent-runtime images through the Windows Docker engine, so the agent never starts.

Evidence

Run: https://github.com/github/gh-aw/actions/runs/39230724467

Failed probe job: windows_probe / agent (job 117988607870), step Download container images. The downloaded log shows:

shell: C:\Program Files\Git\bin\bash.EXE --noprofile --norc -e -o pipefail {0}
Starting download of 6 image(s) with max 4 concurrent downloads...
no matching manifest for windows(10.0.26100)/amd64 in the manifest list entries
Failed to pull ghcr.io/github/gh-aw-firewall/agent:0.28.62@sha256:... after 3 attempts
##[error]Process completed with exit code 123.

windows_probe / conclusion then failed only as a downstream consequence of the skipped agent execution. Its completed-job log was also downloaded and inspected.

Root cause

pkg/workflow/windows_runner.go currently converts generated Unix steps to shell: bash, which selects Git Bash on windows-latest, not WSL. Consequently actions/setup/sh/download_docker_images.sh invokes the host Docker CLI, whose engine requests the Windows platform. The framework images are Linux images, so manifest resolution fails before Codex, AWF, or the MCP gateway can start.

Proposed increment

Add a Windows WSL dispatch path for compiler-generated Unix runtime setup and execution steps, beginning with the agent-runtime bootstrap and image-pull path. Replace the Windows-specific Git-Bash rewriting in pkg/workflow/windows_runner.go with a tested wrapper that invokes the generated Unix commands through WSL and preserves the required paths/environment for the runtime. Ensure the Docker pull and subsequent agent runtime execute in WSL, where Linux image manifests are selected.

Likely files: pkg/workflow/windows_runner.go, pkg/workflow/jobs_test.go, the generated runtime-step templates that emit Download container images, and .github/workflows/windows.md / its compiled lock file for the probe coverage.

Non-goals

• Do not publish Windows container variants of the framework images.
• Do not move Codex, AWF, or other MCP servers onto the Windows host.
• Do not expose a general host shell; host operations remain behind the narrow terminal tool served by host-side mcp-scripts.
• Do not redesign the full host-terminal MCP boundary in this increment.

Acceptance criteria

• Compiling a runs-on: windows-latest workflow emits a WSL-backed execution path for generated Unix runtime commands rather than Git Bash.
• The Windows agent job pulls the pinned Linux runtime images without a no matching manifest for windows(...) error.
• The Codex/AWF agent runtime runs inside WSL; the Windows host runs only the mcp-scripts HTTP server and any host command remains reachable solely through its narrow terminal tool.
• Unit tests cover Windows step rendering/dispatch, including quoting and path/environment handoff to WSL.
• .github/workflows/windows.md remains a Windows-runner probe and, after recompilation, its windows_probe / agent completes its image-download and agent-execution stages; the reusable-call result is successful when its safe-output task succeeds.

Generated by 🪟 Windows Grower · codex · gpt56 · 36.6 AIC · ⌖ 5.49 AIC · ⊞ 14.5K · ◷

• expires on Oct 26, 2026, 1:43 AM UTC-08:00