Add --firewall and --no-firewall boolean flags to logs command and MCP server for filtering by firewall usage

[Copilot]

The daily-firewall-report.md workflow required manually parsing frontmatter to identify firewall-enabled workflows. This adds --firewall and --no-firewall boolean flags to filter runs based on actual firewall usage from runtime metadata.

Changes

• Added --firewall and --no-firewall boolean flags to gh aw logs command

  • --firewall filters to only runs with firewall enabled
  • --no-firewall filters to only runs without firewall enabled
  • Validates mutual exclusivity (cannot use both flags together)
  • Checks steps.firewall field in aw_info.json (e.g., "squid" when enabled)

• Added firewall and no_firewall boolean parameters to MCP server logs tool

  • Enables filtering by firewall usage through the agentic-workflows MCP server
  • Tool parameters: "firewall": true or "no_firewall": true (boolean values)
  • Includes validation to prevent both parameters being true simultaneously
  • Allows workflows to use structured MCP tool calls instead of bash commands

• Optimized performance by reducing redundant file I/O

  • Parse aw_info.json once per loop iteration instead of multiple times
  • Reuse parsed data across all filters (engine, staged, firewall)

• Updated daily-firewall-report.md workflow

  • Replaced bash commands with MCP server tool calls
  • Uses logs tool with firewall: true boolean parameter to collect firewall-enabled runs
  • Uses audit tool to analyze firewall data from each run
  • Follows agentic workflow best practices

• Added unit tests for firewall field parsing and filtering logic (235 lines)

Usage

CLI Usage:

# Get runs with firewall enabled from last 7 days
gh aw logs --firewall --start-date -7d

# Get runs without firewall
gh aw logs --no-firewall

# Combine with other filters
gh aw logs --firewall --engine copilot -c 50

# Error: cannot use both
gh aw logs --firewall --no-firewall
# error: cannot specify both --firewall and --no-firewall flags

MCP Server Tool Usage:

{
  "firewall": true,
  "start_date": "-7d",
  "count": 100
}

Follows the same pattern as existing --no-staged boolean flag.

Original prompt

Add optional --firewall true/false flag on the "logs" command that allows to select logs based on firewall usage

• check the firewall field in aw info.json
• apply to firewall activity report agentic workflow (instead of network.firewall true)

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[pelikhan]

@copilot

• update logs tool in safe output MCP server
• update daily firewall to use MCP server

[Copilot]

@copilot

• update logs tool in safe output MCP server
• update daily firewall to use MCP server

Updated in d0d37a9:

1. MCP Server logs tool: Added firewall parameter to the logs tool in pkg/cli/mcp_server.go with JSON schema "Filter runs by firewall usage: 'true' (only runs with firewall) or 'false' (only runs without firewall)"

2. daily-firewall-report.md workflow: Updated to use MCP server tools instead of bash commands:

   • Step 1: Uses logs tool with firewall: "true" parameter
   • Step 2: Uses audit tool to analyze firewall data from each run

The workflow now follows agentic workflow best practices by using MCP server tools rather than direct CLI commands.

[Copilot]

Pull Request Overview

This PR adds a new --firewall filter to the gh aw logs command, enabling users to filter workflow runs based on whether they have firewall enabled. The filter accepts "true" (only runs with firewall) or "false" (only runs without firewall).

Key changes:

• Added firewall filtering capability to the logs command, allowing users to filter runs based on firewall usage
• Updated the daily firewall report workflow to use the new logs tool filter instead of manually identifying firewall-enabled workflows
• Added comprehensive test coverage for firewall field parsing and filtering logic

Reviewed Changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
pkg/cli/logs.go	Added firewall filter flag, validation logic, and filtering implementation based on steps.firewall field in aw_info.json
pkg/cli/logs_test.go	Updated test function calls to include the new firewall parameter
pkg/cli/logs_firewall_filter_test.go	Added comprehensive test suite for firewall field parsing, filtering logic, and JSON marshaling
pkg/cli/mcp_server.go	Added firewall parameter to the MCP server's logs tool schema and command argument construction
.github/workflows/daily-firewall-report.md	Updated workflow instructions to use the new logs tool firewall filter instead of manual workflow identification
.github/workflows/daily-firewall-report.lock.yml	Compiled version of the updated daily-firewall-report workflow

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The validation logic allows empty strings but should also validate the value when passed to the MCP server. The MCP server's logsArgs struct has no validation, so invalid values could be passed through the MCP interface. Consider adding validation in the MCP server handler or documenting that the MCP tool relies on CLI validation.

[Copilot]

The parseAwInfo function is called multiple times for the same file within the same loop iteration (engine filter at line 617, staged filter at line 617, and now firewall filter at line 635). Consider parsing the aw_info.json file once per iteration and reusing the parsed result across all filters to avoid redundant file I/O and JSON parsing.

[Copilot]

The documentation states that the firewall parameter should be a string "true", but the code validates it as a string. While technically correct, it would be clearer to document that this is a string value, not a boolean. Consider adding quotes in the documentation or explicitly stating 'the string "true"' to avoid confusion for users who might try to pass a boolean value.

[pelikhan]

@copilot firewall cli value should be a Boolean, apply review comments

[Copilot]

@copilot firewall cli value should be a Boolean, apply review comments

Updated in 9a169be:

1. Converted to boolean flags: Changed from --firewall "true"/"false" to --firewall and --no-firewall boolean flags
2. Added validation: Both CLI and MCP server validate mutual exclusivity (cannot use both flags together)
3. Optimized parseAwInfo: Reduced from 3 calls per iteration to 1 call, reusing parsed data across all filters (engine, staged, firewall)
4. Updated documentation: Clarified boolean type in workflow examples ("firewall": true instead of "firewall": "true")

CLI usage:

gh aw logs --firewall           # Only runs with firewall
gh aw logs --no-firewall        # Only runs without firewall

MCP tool usage:

{"firewall": true, "start_date": "-7d"}