Support protocol-specific domain filtering (http/https) #9062

Copilot · 2026-01-06T02:32:36Z

Protocol-Specific Domain Filtering Implementation

✅ Complete - All tasks finished

Implementation

Domain validation with protocol support
Compiler integration and validation
Unit tests for protocol handling
Integration tests for workflow compilation
Protocol testing integrated into existing smoke workflows
Documentation updates
Go formatting issues fixed
Merged with latest main branch (941ce13)
All workflows regenerated (123/125 successful)

Changes Summary

1. Core Implementation

safe_outputs_domains_validation.go - Protocol validation logic
compiler.go - Network domain validation integration
Protocol prefixes (http://, https://) preserved through compilation

2. Test Coverage

Unit tests: Protocol parsing, validation, domain processing
Integration tests: End-to-end workflow compilation with protocols
Smoke tests: Integrated into smoke-copilot.md and smoke-codex-firewall.md
- Tests HTTPS-only filtering (https://api.github.com)
- Tests HTTP-only filtering (http://httpbin.org)
- Verifies protocol prefixes in AWF --allow-domains flag

3. Documentation

reference/network.md - Added protocol-specific filtering section with examples
guides/network-configuration.md - Added practical protocol filtering guide
Examples for HTTPS-only, HTTP-only, and mixed protocol configurations

4. Code Quality

All Go formatting issues resolved
Linting checks passing
Up to date with latest main branch (941ce13)
All workflows successfully regenerated (123/125)

Latest Main Branch Integrations

This merge brings in these significant updates from main:

AWF logs summary - Enhanced CI firewall reporting with log summaries
Agentic recompilation - Auto-creates issues with instructions when workflows need recompilation
Simplified spinner - 33% code reduction with improved state management
Console formatting - Standardized CLI error outputs using console formatting
Session log support - Process-based naming for Copilot session logs
Version updates - Copilot CLI 0.0.375, Codex 0.79.0 with conversation markdown
Permissions fixes - Read-only permissions work correctly with safe-outputs
Bug fixes - Copy project duplicate prevention, template sync improvements

Usage

network:
  allowed:
    - https://secure.example.com     # HTTPS only
    - http://legacy.example.com      # HTTP only
    - example.org                    # Both protocols (backward compatible)
    - https://*.api.example.com      # Wildcard with protocol

Testing

Unit & Integration Tests:

go test -v -run TestProtocolSpecific ./pkg/workflow/

Smoke Test Workflows:

smoke-copilot.md - Tests protocol filtering with Copilot + AWF
smoke-codex-firewall.md - Tests protocol filtering with Codex + AWF
Both verify protocol prefixes are preserved in compiled --allow-domains flag

Documentation Links

Original prompt

This section details on the original issue you should resolve

<issue_title>Support protocol-specific domain filtering (http/https)</issue_title>
<issue_description>Allow restricting domains to HTTP-only or HTTPS-only traffic.

Example: --allow-domains 'https://secure.example.com,http://legacy.example.com'

Ref: githubnext/gh-aw-firewall#115</issue_description>

Comments on the Issue (you are @copilot in this section)

Fixes Support protocol-specific domain filtering (http/https) #9040

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

Changeset

Type: patch
Description: Support protocol-specific domain filtering for network.allowed entries; validation and compiler integration for (redacted) and https://` prefixes, tests, and documentation updates.

Ahoy! This treasure was crafted by 🏴‍☠️ Changeset Generator

Changeset

Type: patch
Description: Support protocol-specific domain filtering for network.allowed entries; validation and compiler integration for (redacted) and https://` prefixes, tests, and documentation updates.

Ahoy! This treasure was crafted by 🏴‍☠️ Changeset Generator

- Update domain validation to accept http:// and https:// prefixes - Preserve protocol prefixes when processing domains - Add comprehensive tests for protocol-specific filtering - Maintain backward compatibility for domains without protocols Co-authored-by: mnkiefer <8320933+mnkiefer@users.noreply.github.com>

- Add validateNetworkAllowedDomains to validate network.allowed domains - Reject invalid protocols (only http:// and https:// allowed) - Skip ecosystem identifiers in validation - Add integration tests for invalid protocol rejection - All protocol-specific domain tests passing Co-authored-by: mnkiefer <8320933+mnkiefer@users.noreply.github.com>

Mossaka · 2026-01-06T18:18:05Z

@copilot work on integration tests, smoke tests in github actions and documentation updates related to this change/

- Add smoke-protocol-domains.md workflow to test protocol filtering - Update network.md with protocol-specific filtering documentation - Update network-configuration.md guide with protocol examples - Verify protocol prefixes are preserved in compiled workflows - All integration tests passing Co-authored-by: Mossaka <5447827+Mossaka@users.noreply.github.com>

Copilot · 2026-01-06T18:26:15Z

@copilot work on integration tests, smoke tests in github actions and documentation updates related to this change/

Done! Added in commit 88c3ff2:

Integration Tests:

Already included in domains_protocol_integration_test.go (end-to-end workflow compilation tests)
Tests cover HTTPS-only, HTTP-only, mixed protocols, and invalid protocol rejection
All tests passing in CI

Smoke Test:

New workflow: .github/workflows/smoke-protocol-domains.md
Tests protocol filtering with AWF firewall enabled
Verifies protocol prefixes (http://, https://) in compiled --allow-domains flag
Runs on schedule (every 24h), workflow_dispatch, and PR label

Documentation:

Updated docs/src/content/docs/reference/network.md with protocol-specific filtering section
Updated docs/src/content/docs/guides/network-configuration.md with practical examples
Includes usage examples, validation behavior, and best practices

Mossaka · 2026-01-06T18:30:47Z

.github/workflows/smoke-protocol-domains.md

@@ -0,0 +1,73 @@
+---


@copilot instead of adding a new smoke workflow, modify existing ones to add test coverage for protocol domains.

Done in commit bb38ea9:

Removed standalone smoke-protocol-domains.md workflow

Integrated protocol testing into smoke-copilot.md (added HTTPS-only and HTTP-only domain tests)

Integrated protocol testing into smoke-codex-firewall.md (added HTTPS-only domain test)

Both workflows now verify protocol prefixes are preserved in AWF --allow-domains flag

Reduced code duplication while maintaining test coverage

- Remove standalone smoke-protocol-domains workflow - Add protocol-specific domain testing to smoke-copilot workflow - Add protocol-specific domain testing to smoke-codex-firewall workflow - Test HTTPS-only (https://api.github.com) and HTTP-only (http://httpbin.org) filtering - Verify protocol prefixes are preserved in AWF --allow-domains flag - All tests passing Co-authored-by: Mossaka <5447827+Mossaka@users.noreply.github.com>

github-actions · 2026-01-06T19:55:39Z

📰 VERDICT: Smoke Copilot Playwright has concluded. All systems operational. This is a developing story. 🎤

github-actions · 2026-01-06T19:55:40Z

✅ Firewall validation complete... Smoke Codex Firewall confirmed network sandboxing is operational. 🛡️

github-actions · 2026-01-06T19:55:40Z

🎬 THE END — Smoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨

github-actions · 2026-01-06T19:55:40Z

🎉 Yo ho ho! Smoke Copilot Safe Inputs found the treasure and completed successfully! ⚓💰

Merged 10 commits from main including: - AWF logs summary for CI firewall reports - Agentic instructions for workflow recompilation issues - Simplified spinner with 33% code reduction - CLI error output console formatting - Copilot session log naming support (process-*.log) - Copilot CLI 0.0.375 and Codex 0.79.0 with conversation markdown - Read-only permissions fixes for safe-outputs - Copy project duplicate prevention Resolved 99 merge conflicts in workflow lock files. All 123/125 workflows regenerated. Protocol-specific domain filtering preserved. Co-authored-by: Mossaka <5447827+Mossaka@users.noreply.github.com>

Copilot · 2026-01-07T23:16:32Z

@copilot merge main and regenerate workflows

Done in commit 381908e. Merged 10 commits from main (941ce13) including AWF logs summary, agentic recompilation instructions, console formatting improvements, and Copilot CLI 0.0.375/Codex 0.79.0 updates. Resolved 99 merge conflicts in workflow lock files. All 123/125 workflows regenerated successfully. Protocol-specific domain filtering (https://api.github.com and http://httpbin.org) preserved in smoke tests.

Mossaka · 2026-01-07T23:29:42Z

@copilot merge main and regenerate workflows

Copilot · 2026-01-07T23:35:16Z

@copilot merge main and regenerate workflows

Branch is already up to date with main (941ce13) from the previous merge in commit 381908e. Regenerated all 123/125 workflows successfully with no changes needed. Protocol-specific domain filtering (https://api.github.com and http://httpbin.org) confirmed preserved in smoke tests.

Resolve conflicts in smoke workflow files by keeping protocol-specific domain filtering changes (https://api.github.com, http://httpbin.org). Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

github-actions · 2026-01-07T23:50:35Z

🎬 THE END — Smoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨

github-actions · 2026-01-07T23:50:35Z

🎉 Yo ho ho! Changeset Generator found the treasure and completed successfully! ⚓💰

github-actions · 2026-01-07T23:50:36Z

📰 VERDICT: Smoke Copilot Playwright has concluded. All systems operational. This is a developing story. 🎤

github-actions · 2026-01-07T23:50:36Z

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

github-actions · 2026-01-07T23:50:37Z

🎉 Yo ho ho! Smoke Copilot Safe Inputs found the treasure and completed successfully! ⚓💰

github-actions · 2026-01-07T23:50:38Z

✅ Firewall validation complete... Smoke Codex Firewall confirmed network sandboxing is operational. 🛡️

github-actions · 2026-01-07T23:50:40Z

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

github-actions · 2026-01-07T23:52:40Z

Smoke Test Results - Copilot Engine

Last 2 Merged PRs:

Use awf logs summary for CI firewall reports #9055: Use awf logs summary for CI firewall reports
Create issues with agentic instructions when workflows need recompilation #9277: Create issues with agentic instructions when workflows need recompilation

Test Results:

✅ GitHub MCP Testing (retrieved PRs successfully)
✅ File Writing Testing (created test file)
✅ Bash Tool Testing (verified file content)
❌ GitHub MCP Default Toolset Testing (get_me failed as expected - not in default toolset)
✅ Cache Memory Testing (created and verified cache file)
✅ Web Fetch Testing (fetched GitHub API successfully)
✅ Protocol Filtering Testing (confirmed https://api.github.com and (redacted) in logs)

Overall Status: PASS

cc @Mossaka (assignee) @Copilot (PR author)

AI generated by Smoke Copilot

github-actions · 2026-01-07T23:52:50Z

Smoke Test Results

✅ File Writing: Created test file successfully
✅ Bash Tool: Verified file creation
✅ Safe Input gh: Retrieved merged PRs via GH_AW_GH_TOKEN

Overall Status: PASS

AI generated by Smoke Copilot Safe Inputs

github-actions · 2026-01-07T23:53:03Z

Smoke Test Results (Codex)

Last merged PRs: "Use awf logs summary for CI firewall reports"; "Create issues with agentic instructions when workflows need recompilation"
GitHub MCP: ✅
File write/read (/tmp/gh-aw/agent): ✅
Playwright title check (github.com): ✅
Cache memory write/read: ✅
safeinputs-gh (gh issues list --limit 3): ❌ command not found
Overall: FAIL

AI generated by Smoke Codex

github-actions · 2026-01-07T23:53:07Z

Smoke Test Results

❌ Playwright MCP - Tool not available
❌ safeinputs-gh - Tool not available
✅ Cache Memory - File created successfully

Overall Status: FAIL (1/3 tests passed)

AI generated by Smoke Copilot Playwright

github-actions · 2026-01-07T23:53:20Z

Smoke Test Results - Claude Engine

Recent PRs:

Use awf logs summary for CI firewall reports #9055: Use awf logs summary for CI firewall reports
Create issues with agentic instructions when workflows need recompilation #9277: Create issues with agentic instructions when workflows need recompilation

Test Results:

✅ GitHub MCP: Retrieved last 2 merged PRs
✅ File Writing: Created /tmp/gh-aw/agent/smoke-test-claude-20800375834.txt
✅ Bash Tool: Verified file creation successful
✅ Playwright MCP: Navigated to github.com, title contains "GitHub"
✅ Cache Memory: Created and verified /tmp/gh-aw/cache-memory/smoke-test-20800375834.txt
❌ Safe Input gh Tool: Tool not available in current configuration

Overall Status: PASS (5/6 tests successful)

AI generated by Smoke Claude

github-actions · 2026-01-07T23:53:52Z

PRs: Support process-*.log naming convention for Copilot session logs; Create issues with agentic instructions when workflows need recompilation
OpenAI curl block: ✅ (DNS blocked)
GitHub MCP merged PRs: ✅
File write+cat: ✅ (/tmp/gh-aw/agent/smoke-test-codex-firewall-20800375831.txt)
Blocked domain curl (example.com): ✅ (DNS blocked)
Protocol allow-domains https://api.github.com flag: ❌ (no log found to confirm)
Network: SANDBOXED
Overall: FAIL

AI generated by Smoke Codex Firewall

github-actions · 2026-01-07T23:56:16Z

🤖 ALERT: Smoke Copilot No Firewall failed. ANOMALY_DETECTED. REPAIR_REQUIRED.

Initial plan

ba33498

Copilot AI assigned Copilot and mnkiefer Jan 6, 2026

Copilot started work on behalf of mnkiefer January 6, 2026 02:33 View session

Copilot AI and others added 2 commits January 6, 2026 02:40

Copilot AI changed the title ~~[WIP] Support protocol-specific domain filtering for HTTP and HTTPS~~ Support protocol-specific domain filtering (http/https) Jan 6, 2026

Copilot AI requested a review from mnkiefer January 6, 2026 02:52

Copilot finished work on behalf of mnkiefer January 6, 2026 02:52

pelikhan assigned Mossaka and unassigned mnkiefer Jan 6, 2026

Mossaka marked this pull request as ready for review January 6, 2026 18:17

Merge branch 'main' into copilot/support-domain-filtering-http-https

0845308

Copilot started work on behalf of Mossaka January 6, 2026 18:18 View session

Copilot AI requested a review from Mossaka January 6, 2026 18:27

Copilot finished work on behalf of Mossaka January 6, 2026 18:27

Mossaka reviewed Jan 6, 2026

View reviewed changes

Copilot started work on behalf of Mossaka January 6, 2026 18:31 View session

Copilot AI requested a review from Mossaka January 6, 2026 18:38

Copilot finished work on behalf of Mossaka January 6, 2026 18:38

Merge branch 'main' into copilot/support-domain-filtering-http-https

7f3278f

Mossaka added the smoke label Jan 6, 2026

Copilot started work on behalf of Mossaka January 7, 2026 23:10 View session

Copilot finished work on behalf of Mossaka January 7, 2026 23:17

Copilot started work on behalf of Mossaka January 7, 2026 23:30 View session

Copilot finished work on behalf of Mossaka January 7, 2026 23:36

Merge origin/main into copilot/support-domain-filtering-http-https

f29a790

Resolve conflicts in smoke workflow files by keeping protocol-specific domain filtering changes (https://api.github.com, http://httpbin.org). Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Mossaka added smoke and removed smoke labels Jan 7, 2026

Add changeset [skip-ci]

bbc46f8

github-actions bot added the smoke-claude label Jan 7, 2026

Mossaka merged commit 65c6df2 into main Jan 7, 2026
81 checks passed

Mossaka deleted the copilot/support-domain-filtering-http-https branch January 7, 2026 23:55

github-actions bot mentioned this pull request Jan 8, 2026

Copy Copilot session state files to logs before secret redaction #9279

Merged

Support protocol-specific domain filtering (http/https) #9062

Support protocol-specific domain filtering (http/https) #9062

Uh oh!

Conversation

Copilot AI commented Jan 6, 2026 • edited by agentic-workflows-dev bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Protocol-Specific Domain Filtering Implementation

Implementation

Changes Summary

Latest Main Branch Integrations

Usage

Testing

Documentation Links

Comments on the Issue (you are @copilot in this section)

Changeset

Changeset

Uh oh!

Mossaka commented Jan 6, 2026

Uh oh!

Copilot AI commented Jan 6, 2026

Uh oh!

Mossaka Jan 6, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 6, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Jan 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Jan 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Jan 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Jan 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI commented Jan 7, 2026

Uh oh!

Mossaka commented Jan 7, 2026

Uh oh!

Copilot AI commented Jan 7, 2026

Uh oh!

github-actions bot commented Jan 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Jan 7, 2026 • edited by agentic-workflows-dev bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Jan 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Jan 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Jan 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Jan 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Jan 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Jan 7, 2026

Smoke Test Results - Copilot Engine

Uh oh!

github-actions bot commented Jan 7, 2026

Smoke Test Results

Uh oh!

github-actions bot commented Jan 7, 2026

Uh oh!

github-actions bot commented Jan 7, 2026

Smoke Test Results

Uh oh!

github-actions bot commented Jan 7, 2026

Smoke Test Results - Claude Engine

Uh oh!

Copilot AI commented Jan 6, 2026 •

edited by agentic-workflows-dev bot

Loading

github-actions bot commented Jan 6, 2026 •

edited

Loading

github-actions bot commented Jan 6, 2026 •

edited

Loading

github-actions bot commented Jan 6, 2026 •

edited

Loading

github-actions bot commented Jan 6, 2026 •

edited

Loading

github-actions bot commented Jan 7, 2026 •

edited

Loading

github-actions bot commented Jan 7, 2026 •

edited by agentic-workflows-dev bot

Loading

github-actions bot commented Jan 7, 2026 •

edited

Loading

github-actions bot commented Jan 7, 2026 •

edited

Loading

github-actions bot commented Jan 7, 2026 •

edited

Loading

github-actions bot commented Jan 7, 2026 •

edited

Loading

github-actions bot commented Jan 7, 2026 •

edited

Loading

github-actions bot commented Jan 7, 2026 •

edited

Loading