Integrate AWF for Claude engine #6905

Copilot · 2025-12-19T00:01:54Z

AWF Integration for Claude Engine

This PR integrates Application-level Firewall (AWF) for the Claude engine following the Copilot pattern. Deprecates Python hooks entirely—AWF is now the sole network restriction mechanism for Claude.

Core Changes

Domain allowlist (domains.go): Added ClaudeDefaultDomains with Anthropic services, GitHub, infrastructure (CRL/OCSP), package managers, Playwright
Firewall support (claude_engine.go): Set supportsFirewall: true, AWF wraps Claude CLI with --tty flag, domain allowlist, required mounts
Default enablement (firewall.go): Added enableFirewallByDefaultForClaude() mirroring Copilot behavior
Observability (compiler_yaml_main_job.go): Added firewall log upload/parsing steps for Claude

Removed (deprecated)

engine_network_hooks.go — Python hook generation
claude_settings.go — Settings file generation for hooks

AWF Command Structure

sudo -E awf \
  --tty \
  --allow-domains *.githubusercontent.com,anthropic.com,api.anthropic.com,... \
  --mount /home/runner/work/... \
  --mount /tmp \
  --mount /usr/bin/node,/usr/bin/npx \
  --mount ~/.npm \
  --proxy-logs-dir /tmp/gh-aw/sandbox/firewall/logs \
  -- npx @anthropic-ai/claude-code@<version> ...

Behavior

AWF enabled when network.firewall: true is set (or enabled by default when network restrictions present)
Disableable via sandbox.agent: false
Reuses existing parse_firewall_logs.cjs (engine-agnostic)

Merged with main

Resolved merge conflicts in multiple files to incorporate Codex AWF support alongside Claude AWF support:

pkg/workflow/compiler_yaml_main_job.go: Added both Claude and Codex firewall log collection steps
pkg/workflow/domains.go: Added ClaudeDefaultDomains alongside CodexDefaultDomains and merged domain functions
pkg/workflow/domains_test.go: Added tests for both Claude and Codex domain functions
pkg/workflow/firewall.go: Updated comment to include all supported engines (copilot, claude, codex)

Original prompt

Overview

Integrate Application-level Firewall (AWF) for the Claude engine following the Copilot pattern, providing network isolation for Claude Code CLI via domain allowlisting.

User decisions

AWF enabled by default for Claude (like Copilot)
Deprecate Python hooks entirely (AWF is the only network restriction mechanism)
Pre-install Claude CLI during installation steps and mount required binaries (like Copilot)

Phase 1: Core AWF integration

1.1 Add Claude default domains

File: /home/mossaka/developer/gh-aw-repos/gh-aw/pkg/workflow/domains.go
Add after CopilotDefaultDomains:

// ClaudeDefaultDomains are the default domains required for Claude Code CLI authentication and operation
var ClaudeDefaultDomains = []string{
    "*.githubusercontent.com",
    "anthropic.com",
    "api.anthropic.com",
    "api.github.com",
    "api.snapcraft.io",
    "archive.ubuntu.com",
    "azure.archive.ubuntu.com",
    "cdn.playwright.dev",
    "codeload.github.com",
    "crl.geotrust.com",
    "crl.globalsign.com",
    "crl.identrust.com",
    "crl.sectigo.com",
    "crl.thawte.com",
    "crl.usertrust.com",
    "crl.verisign.com",
    "crl3.digicert.com",
    "crl4.digicert.com",
    "crls.ssl.com",
    "files.pythonhosted.org",
    "ghcr.io",
    "github-cloud.githubusercontent.com",
    "github-cloud.s3.amazonaws.com",
    "github.com",
    "host.docker.internal",
    "json-schema.org",
    "json.schemastore.org",
    "keyserver.ubuntu.com",
    "lfs.github.com",
    "objects.githubusercontent.com",
    "ocsp.digicert.com",
    "ocsp.geotrust.com",
    "ocsp.globalsign.com",
    "ocsp.identrust.com",
    "ocsp.sectigo.com",
    "ocsp.ssl.com",
    "ocsp.thawte.com",
    "ocsp.usertrust.com",
    "ocsp.verisign.com",
    "packagecloud.io",
    "packages.cloud.google.com",
    "packages.microsoft.com",
    "playwright.download.prss.microsoft.com",
    "ppa.launchpad.net",
    "pypi.org",
    "raw.githubusercontent.com",
    "registry.npmjs.org",
    "s.symcb.com",
    "s.symcd.com",
    "security.ubuntu.com",
    "sentry.io",
    "statsig.anthropic.com",
    "ts-crl.ws.symantec.com",
    "ts-ocsp.ws.symantec.com",
}

Add helper(s) (pattern: merge defaults + NetworkPermissions, deterministic sort; optionally append host.docker.internal when safe-inputs enabled).

1.2 Enable firewall support in the Claude engine

File: /home/mossaka/developer/gh-aw-repos/gh-aw/pkg/workflow/claude_engine.go
Set supportsFirewall: true in NewClaudeEngine().

Phase 2: Installation steps + hook removal

2.1 Update installation steps

File: .../claude_engine.go
Use base install (secret validation + npm install for @anthropic-ai/claude-code) and, when firewall enabled, append AWF installation step.
Note: remove all Python hook install/config logic.

2.2 Remove hook-related files (cleanup commit after verification)

.../engine_network_hooks.go (delete)
.../claude_settings.go (delete)

Phase 3: AWF-wrapped execution

File: .../claude_engine.go
In GetExecutionSteps():

Build Claude command using npx @anthropic-ai/claude-code@<version> ...
If firewall enabled: wrap command with awf using:
- --tty (required)
- --allow-domains <GetClaudeAllowedDomains...()>
- mounts: workspace, /tmp, gh/yq/date, plus node/npx and npm cache dirs needed for the preinstalled package
- --proxy-logs-dir /tmp/gh-aw/sandbox/firewall/logs
Else: run Claude directly (baseline / sandbox.agent: false)

Phase 4: Observability & log parsing

Reuse existing js/parse_firewall_logs.cjs (engine-agnostic).
Keep Claude parsing via js/parse_claude_log.cjs.
In compiler_yaml_main_job.go, add Claude firewall log upload/parsing steps around the same places as Copilot.

Phase 5: Testing

Add .github/workflows/smoke-claude-firewall.md with firewall enabled and allowed network presets; validate:
- CLI invocation via npx inside AWF
- domain allowlist enforcement
- logs produced + parsed
Update .github/workflows/smoke-claude.md with sandbox.agent: false for comparison.

Phase 6: Default enablement

File: /pkg/workflow/firewall.go
Ensure Claude follows the same “enabled by default” logic as Copilot (e.g., copilot || claude).

Critical files summary

Modify

pkg/workflow/domains.go (ClaudeDefaultDomains + merge helper)
pkg/workflow/claude_engine.go (supportsFirewall, install, exec wrapper)
pkg/workflow/compiler_yaml_main_job.go (log steps)
pkg/workflow/firewall.go (default enablement, if needed)

Create

.github/workflows/smoke-claude-firewall.md

Delete (post-verify)

pkg/workflow/engine_network_hooks.go
pkg/workflow/claude_settings.go

...

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

pelikhan · 2025-12-19T04:27:08Z

@copilot merge main

Copilot · 2025-12-19T04:33:23Z

@copilot merge main

Merged main into this branch in cff0dc0. Resolved merge conflict in pkg/workflow/compiler_parse.go and recompiled lock files.

Mossaka · 2025-12-19T04:41:28Z

@copilot reduce the mounts to only --mount /tmp:/tmp:rw --mount "${GITHUB_WORKSPACE}:${GITHUB_WORKSPACE}:rw"

github-actions · 2025-12-19T04:50:50Z

🎉 Yo ho ho! Changeset Generator found the treasure and completed successfully! ⚓💰

github-actions · 2025-12-19T04:50:50Z

💫 TO BE CONTINUED... Smoke Claude failed! Our hero faces unexpected challenges...

github-actions · 2025-12-19T04:50:50Z

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

github-actions · 2025-12-19T04:50:51Z

🤖 DIAGNOSTIC COMPLETE: Smoke Copilot No Firewall STATUS: ALL_UNITS_OPERATIONAL. MISSION_SUCCESS.

github-actions · 2025-12-19T04:50:51Z

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

github-actions · 2025-12-19T04:50:51Z

🎉 Yo ho ho! Smoke Copilot Safe Inputs found the treasure and completed successfully! ⚓💰

All Claude engine workflows now use minimal AWF mounts: - /tmp:/tmp:rw - ${GITHUB_WORKSPACE}:${GITHUB_WORKSPACE}:rw 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 <[email protected]>

Mount only essential components for Claude CLI: - /usr/local/bin/node (Node.js runtime) - /usr/local/bin/claude (Claude CLI executable) - /usr/local/lib/node_modules/@Anthropic-AI (Claude package only, not all node_modules) This surgical approach provides Claude CLI functionality while minimizing the attack surface compared to mounting all of node_modules, npm, npx, and npm cache. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 <[email protected]>

Instead of mounting /usr/local/bin/claude (which doesn't exist in GitHub Actions), invoke Claude directly: node /usr/local/lib/node_modules/@anthropic-ai/claude-code/cli.js Minimal mounts now: - /usr/local/bin/node (Node.js runtime) - /usr/local/lib/node_modules/@Anthropic-AI (Claude package directory) This approach works regardless of where npm creates the claude binary symlink. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 <[email protected]>

GitHub Actions' setup-node installs to /opt/hostedtoolcache/node, not /usr/local. Mount this entire directory (read-only) to give AWF container access to: - Node.js runtime - npm and npx - All globally installed packages (including Claude CLI) This pragmatic approach avoids path guessing while keeping the mount read-only. AWF's security value comes from network isolation, not filesystem isolation. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 <[email protected]>

Prepend hostedtoolcache node bin directory to PATH before invoking Claude. This ensures the claude command is found inside the AWF container even though GitHub Actions installs it in a non-standard location. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 <[email protected]>

Replace PATH manipulation with npx invocation: - npx --yes @anthropic-ai/claude-code (explicit, clean) - No shell command substitution needed - No PATH exports - More maintainable and explicit about what we're running Mount remains the same (/opt/hostedtoolcache/node) but command is cleaner. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 <[email protected]>

Use the configured Claude version (defaults to 2.0.71) in npx command: - npx --yes @anthropic-ai/[email protected] - Ensures version used matches installed version - Improves security and reproducibility - Version controlled by constants.DefaultClaudeCodeVersion 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 <[email protected]>

The claudeVersion variable needs to be defined in GetExecutionSteps function, not just GetInstallationSteps. This ensures npx invocation uses the correct pinned version (2.0.71 by default, or custom if configured). 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 <[email protected]>

npx breaks MCP server launching (serena fails to connect). Revert to PATH export approach which keeps environment complete: - export PATH="...hostedtoolcache/node/.../bin:$PATH" && claude - Ensures all npm/node binaries available for MCP server spawning - Mount: /opt/hostedtoolcache/node:ro (read-only, pragmatic) 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 <[email protected]>

Resolved merge conflicts: - pkg/workflow/compiler_yaml_main_job.go: Added both Claude and Codex firewall log collection steps - pkg/workflow/domains.go: Added ClaudeDefaultDomains alongside new CodexDefaultDomains and merged domain functions - pkg/workflow/domains_test.go: Added tests for both Claude and Codex domain functions - pkg/workflow/firewall.go: Updated comment to include all supported engines Co-authored-by: pelikhan <[email protected]>

Remove duplicate TestCodexDefaultDomains and TestGetCodexAllowedDomains functions that were accidentally introduced during rebase conflict resolution. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <[email protected]>

github-actions · 2025-12-19T21:09:34Z

🤖 DIAGNOSTIC COMPLETE: Smoke Copilot No Firewall STATUS: ALL_UNITS_OPERATIONAL. MISSION_SUCCESS.

github-actions · 2025-12-19T21:09:35Z

🎬 THE END — Smoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨

github-actions · 2025-12-19T21:09:35Z

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

github-actions · 2025-12-19T21:09:36Z

🎉 Yo ho ho! Smoke Copilot Safe Inputs found the treasure and completed successfully! ⚓💰

github-actions · 2025-12-19T21:09:37Z

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

github-actions · 2025-12-19T21:09:37Z

🎉 Yo ho ho! Changeset Generator found the treasure and completed successfully! ⚓💰

github-actions · 2025-12-19T21:09:38Z

✅ Firewall validation complete... Smoke Codex Firewall confirmed network sandboxing is operational. 🛡️

github-actions · 2025-12-19T21:11:55Z

Smoke Test Results - Run 20382606336

Recent PRs:

[WIP] Update Codex CLI to v0.76.0 #7002: [WIP] Update Codex CLI to v0.76.0
[WIP] Update outdated files generated by init command #7004: [WIP] Update outdated files generated by init command

Test Results:

✅ GitHub MCP - Retrieved last 2 merged PRs
✅ File Writing - Created agent test file
✅ Bash Tool - Verified file contents
❌ GitHub MCP Default Toolset - get_me failed (expected - not in default toolsets)
✅ Cache Memory - Created and verified cache file

Available Tools: add_comment, add_labels, create_issue, missing_tool, noop

Overall: PASS

cc @Mossaka

📰 BREAKING: Report filed by Smoke Copilot fer issue #6905 🗺️

github-actions · 2025-12-19T21:11:56Z

Smoke Test Results - Copilot Engine (No Firewall)

Last 2 Merged PRs:

Fix create-agentic-workflow agent prompting patterns #6999: Fix create-agentic-workflow agent prompting patterns
Restructure campaign designer to match workflow designer two-mode pattern #6996: Restructure campaign designer to match workflow designer two-mode pattern

Test Results:

✅ GitHub MCP: Retrieved PR information
✅ File Writing: Created /tmp/gh-aw/agent/smoke-test-copilot-20382606338.txt
✅ Bash Tool: Verified file creation successful
✅ Playwright MCP: Navigated to github.com, title contains "GitHub"
❌ Safe Input gh Tool: Authentication not configured in bash

Overall Status: PASS (4/5 tests successful - gh tool requires GITHUB_TOKEN which is expected limitation)

🤖 DIAGNOSTIC REPORT GENERATED BY Smoke Copilot No Firewall fer issue #6905 🗺️

github-actions · 2025-12-19T21:12:01Z

PRs: #6999 Fix create-agentic-workflow agent prompting patterns; #6996 Restructure campaign designer to match workflow designer two-mode pattern
OpenAI access: ❌ (DNS blocked)
GitHub MCP PR fetch: ✅
File write/read: ✅ (/tmp/gh-aw/agent/smoke-test-codex-firewall-20382606389.txt)
Blocked domain (example.com): ✅ (blocked)
Network: SANDBOXED
Overall: FAIL

🔥 Firewall tested by Smoke Codex Firewall fer issue #6905 🗺️

github-actions · 2025-12-19T21:12:09Z

Smoke Test Results

GitHub MCP: ✅ (Last 2 merged PRs reviewed)
File Writing: ✅ (Created smoke-test-copilot-20382606332.txt)
Bash Tool: ✅ (Verified file creation)
Serena MCP: ✅ (Listed project classes)
Safe Input gh: ✅ (Accessed GitHub issues)

Overall Status: PASS

Ahoy! This treasure was crafted by 🏴‍☠️ Smoke Copilot Safe Inputs fer issue #6905 🗺️

github-actions · 2025-12-19T21:12:35Z

Smoke Test Results

PRs: [WIP] Update Codex CLI to v0.76.0, [WIP] Update outdated files generated by init command

✅ GitHub MCP - Retrieved 2 recent PRs
✅ File Writing - Created /tmp/gh-aw/agent/smoke-test-claude-20382606347.txt
✅ Bash Tool - Verified file creation
✅ Playwright - Navigated to GitHub, title confirmed
✅ Cache Memory - Created /tmp/gh-aw/cache-memory/smoke-test-20382606347.txt
❌ Safe Input gh Tool - Tool not available

Overall: PARTIAL PASS (5/6 tests passed)

💥 [THE END] — Illustrated by Smoke Claude fer issue #6905 🗺️

github-actions · 2025-12-19T21:13:41Z

Recent merged PRs: Fix create-agentic-workflow agent prompting patterns; Restructure campaign designer to match workflow designer two-mode pattern
GitHub MCP merged PR fetch: ✅
File write/verify (/tmp/gh-aw/agent): ✅
Playwright title contains "GitHub": ✅
Cache memory write/verify: ✅
safeinputs-gh gh issues list: ❌ (command not found in PATH)
Overall: FAIL

🔮 The oracle has spoken through Smoke Codex fer issue #6905 🗺️

Copilot AI assigned Copilot and Mossaka Dec 19, 2025

Copilot started work on behalf of Mossaka December 19, 2025 00:02 View session

Copilot AI changed the title ~~[WIP] Integrate application-level firewall for Claude engine~~ Integrate AWF for Claude engine Dec 19, 2025

Copilot AI requested a review from Mossaka December 19, 2025 01:00

Copilot finished work on behalf of Mossaka December 19, 2025 01:00

Base automatically changed from copilot/bump-awf-version-to-v070 to main December 19, 2025 03:57

Copilot started work on behalf of pelikhan December 19, 2025 04:27 View session

Copilot AI requested a review from pelikhan December 19, 2025 04:34

Copilot finished work on behalf of pelikhan December 19, 2025 04:34

pelikhan added the smoke label Dec 19, 2025

Copilot started work on behalf of Mossaka December 19, 2025 04:41 View session

Mossaka force-pushed the copilot/integrate-awf-for-claude branch from cff0dc0 to 9681818 Compare December 19, 2025 04:43

Copilot stopped work on behalf of Mossaka due to an error December 19, 2025 04:44
Copilot has encountered an error. See logs for additional details.

Mossaka added smoke and removed smoke labels Dec 19, 2025

This comment has been minimized.

Sign in to view

github-actions bot added smoke-copilot smoke-copilot-no-firewall labels Dec 19, 2025

Mossaka and others added 10 commits December 19, 2025 20:52

Mossaka force-pushed the copilot/integrate-awf-for-claude branch from b7e3d79 to ae5f860 Compare December 19, 2025 20:52

Mossaka added smoke and removed smoke labels Dec 19, 2025

Mossaka merged commit 742584a into main Dec 19, 2025
103 checks passed

Mossaka deleted the copilot/integrate-awf-for-claude branch December 19, 2025 21:18

github-actions bot mentioned this pull request Dec 19, 2025

Use AWF installer script with version pinning when firewall is enabled #6925

Merged

Integrate AWF for Claude engine #6905

Integrate AWF for Claude engine #6905

Uh oh!

Conversation

Copilot AI commented Dec 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

AWF Integration for Claude Engine

Core Changes

Removed (deprecated)

AWF Command Structure

Behavior

Merged with main

Overview

User decisions

Phase 1: Core AWF integration

1.1 Add Claude default domains

1.2 Enable firewall support in the Claude engine

Phase 2: Installation steps + hook removal

2.1 Update installation steps

2.2 Remove hook-related files (cleanup commit after verification)

Phase 3: AWF-wrapped execution

Phase 4: Observability & log parsing

Phase 5: Testing

Phase 6: Default enablement

Critical files summary

Uh oh!

pelikhan commented Dec 19, 2025

Uh oh!

Copilot AI commented Dec 19, 2025

Uh oh!

Mossaka commented Dec 19, 2025

Uh oh!

github-actions bot commented Dec 19, 2025 • edited by agentic-workflows-dev bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Dec 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Dec 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Dec 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Dec 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Dec 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

github-actions bot commented Dec 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Dec 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Dec 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Dec 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Dec 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Dec 19, 2025 • edited by agentic-workflows-dev bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Dec 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Dec 19, 2025

Smoke Test Results - Run 20382606336

Uh oh!

github-actions bot commented Dec 19, 2025

Smoke Test Results - Copilot Engine (No Firewall)

Uh oh!

Copilot AI commented Dec 19, 2025 •

edited

Loading

github-actions bot commented Dec 19, 2025 •

edited by agentic-workflows-dev bot

Loading

github-actions bot commented Dec 19, 2025 •

edited

Loading

github-actions bot commented Dec 19, 2025 •

edited

Loading

github-actions bot commented Dec 19, 2025 •

edited

Loading

github-actions bot commented Dec 19, 2025 •

edited

Loading

github-actions bot commented Dec 19, 2025 •

edited

Loading

github-actions bot commented Dec 19, 2025 •

edited

Loading

github-actions bot commented Dec 19, 2025 •

edited

Loading

github-actions bot commented Dec 19, 2025 •

edited

Loading

github-actions bot commented Dec 19, 2025 •

edited

Loading

github-actions bot commented Dec 19, 2025 •

edited

Loading

github-actions bot commented Dec 19, 2025 •

edited by agentic-workflows-dev bot

Loading

github-actions bot commented Dec 19, 2025 •

edited

Loading