feat: add volume mount for ~/.copilot/session-state

Agent-Logs-Url: https://github.com/github/gh-aw-firewall/sessions/44f79fbe-75fd-4c92-ae2a-fe47fee65922

Author: Copilot

docs/usage.md

@@ -845,6 +845,12 @@ sudo awf \
 - Location: `/tmp/awf-agent-logs-<timestamp>/`
 - View with: `cat /tmp/awf-agent-logs-<timestamp>/*.log`
 
+**Agent Session State:**
+- Contains structured conversation data written by Copilot CLI (e.g., `events.jsonl`)
+- Location: `/tmp/awf-agent-session-state-<timestamp>/`
+- View with: `cat /tmp/awf-agent-session-state-<timestamp>/events.jsonl`
+- Useful for triage dashboards, benchmarking, and debugging Copilot CLI runs
+
 **Squid Logs:**
 - Contains all HTTP/HTTPS traffic (allowed and denied)
 - Location: `/tmp/squid-logs-<timestamp>/`
@@ -859,9 +865,15 @@ sudo cat /tmp/squid-logs-<timestamp>/access.log
 ```
 
 **How it works:**
-- GitHub Copilot CLI writes to `~/.copilot/logs/`, Squid writes to `/var/log/squid/`
-- Volume mounts map these to `${workDir}/agent-logs/` and `${workDir}/squid-logs/`
-- Before cleanup, logs are automatically moved to `/tmp/awf-agent-logs-<timestamp>/` and `/tmp/squid-logs-<timestamp>/` (if they exist)
+- GitHub Copilot CLI writes to `~/.copilot/logs/` and `~/.copilot/session-state/`; Squid writes to `/var/log/squid/`
+- Volume mounts map container paths to:
+  - `${workDir}/agent-logs/` → `~/.copilot/logs/`
+  - `${workDir}/agent-session-state/` → `~/.copilot/session-state/`
+  - `${workDir}/squid-logs/` → `/var/log/squid/`
+- Before cleanup, non-empty directories are automatically moved to timestamped `/tmp` paths:
+  - `/tmp/awf-agent-logs-<timestamp>/`
+  - `/tmp/awf-agent-session-state-<timestamp>/`
+  - `/tmp/squid-logs-<timestamp>/`
 - Empty log directories are not preserved (avoids cluttering /tmp)
 
 ### Keep Containers for Inspection

src/docker-manager.ts

@@ -736,6 +736,8 @@ export function generateDockerCompose(
     `${workspaceDir}:${workspaceDir}:rw`,
     // Mount agent logs directory to workDir for persistence
     `${config.workDir}/agent-logs:${effectiveHome}/.copilot/logs:rw`,
+    // Mount agent session-state directory to workDir for persistence (events.jsonl)
+    `${config.workDir}/agent-session-state:${effectiveHome}/.copilot/session-state:rw`,
     // Init signal volume for iptables init container coordination
     `${initSignalDir}:/tmp/awf-init:rw`,
   ];
@@ -1548,6 +1550,13 @@ export async function writeConfigs(config: WrapperConfig): Promise<void> {
   }
   logger.debug(`Agent logs directory created at: ${agentLogsDir}`);
 
+  // Create agent session-state directory for persistence (events.jsonl written by Copilot CLI)
+  const agentSessionStateDir = path.join(config.workDir, 'agent-session-state');
+  if (!fs.existsSync(agentSessionStateDir)) {
+    fs.mkdirSync(agentSessionStateDir, { recursive: true });
+  }
+  logger.debug(`Agent session-state directory created at: ${agentSessionStateDir}`);
+
   // Create squid logs directory for persistence
   // If proxyLogsDir is specified, write directly there (timeout-safe)
   // Otherwise, use workDir/squid-logs (will be moved to /tmp after cleanup)
@@ -2104,6 +2113,18 @@ export async function cleanup(workDir: string, keepFiles: boolean, proxyLogsDir?
         }
       }
 
+      // Preserve agent session-state before cleanup (contains events.jsonl from Copilot CLI)
+      const agentSessionStateDir = path.join(workDir, 'agent-session-state');
+      const agentSessionStateDestination = path.join(os.tmpdir(), `awf-agent-session-state-${timestamp}`);
+      if (fs.existsSync(agentSessionStateDir) && fs.readdirSync(agentSessionStateDir).length > 0) {
+        try {
+          fs.renameSync(agentSessionStateDir, agentSessionStateDestination);
+          logger.info(`Agent session state preserved at: ${agentSessionStateDestination}`);
+        } catch (error) {
+          logger.debug('Could not preserve agent session state:', error);
+        }
+      }
+
       // Preserve api-proxy logs before cleanup
       if (proxyLogsDir) {
         // Logs were written directly to sibling of proxyLogsDir during runtime (timeout-safe)