Add domain blocklist support via --block-domains flag #9063

Copilot · 2026-01-06T02:32:37Z

Add domain blocklist support

This PR adds support for --block-domains to block specific domains while allowing others, as requested in githubnext/gh-aw-firewall#114.

Implementation Complete:

Test Results:

✅ TestGetBlockedDomains - 7/7 subtests passed
✅ TestFormatBlockedDomains - 5/5 subtests passed
✅ TestBlockedDomainsWithEngines - 1/1 subtests passed
✅ TestFirewallBlockedDomainsInCopilotEngine - 3/3 subtests passed
✅ TestFirewallBlockedDomainsInClaudeEngine - 1/1 subtests passed
✅ TestFirewallBlockedDomainsInCodexEngine - 1/1 subtests passed
✅ TestBlockedDomainsIntegration - 5/5 subtests passed
✅ Linting - All checks passed

Integration Tests (pkg/workflow/blocked_domains_integration_test.go):

Tests blocked domains compilation for Copilot, Claude, and Codex engines
Verifies --block-domains flag appears correctly in compiled workflows
Verifies ecosystem identifier expansion (e.g., python → pypi.org, files.pythonhosted.org)
Tests that workflows without blocked domains don't include the flag

Smoke Test Workflows (pkg/cli/workflows/test-*-blocked-domains.md):

test-copilot-blocked-domains.md - Blocks PyPI domains while allowing GitHub
test-claude-blocked-domains.md - Blocks NPM domains while allowing GitHub
test-codex-blocked-domains.md - Blocks custom example domains while allowing GitHub
Each validates allowed/blocked domain functionality end-to-end

Key Features:

Supports individual domains: tracker.example.com, analytics.example.com
Supports ecosystem identifiers: python, node, etc.
Blocked domains take precedence over allowed domains
Automatically sorts and deduplicates blocked domains
Only adds --block-domains flag when blocked domains are specified
Works with Copilot, Claude, and Codex engines

Documentation:

Added blocked field description to network reference
Added usage examples and common use cases
Updated full frontmatter reference
Created example workflow in pkg/cli/workflows/example-blocked-domains.md

Ref: githubnext/gh-aw-firewall#114

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

Changeset

Type: patch
Description: Add domain blocklist support via the --block-domains flag and the blocked frontmatter field. This enables specifying domains or ecosystem identifiers to block in workflows and ensures the flag is only added when blocked domains are present.

Ahoy! This treasure was crafted by 🏴‍☠️ Changeset Generator

Co-authored-by: mnkiefer <[email protected]>

pelikhan · 2026-01-06T03:03:26Z

pkg/cli/workflows/example-blocked-domains.md

@@ -0,0 +1,30 @@
+---


@copilot move to pkg/cli/tests

Moved to pkg/cli/workflows/ in commit 9f7de6f.

Co-authored-by: pelikhan <[email protected]>

Mossaka · 2026-01-06T18:18:52Z

@copilot add more integration tests and to smoke tests to verify that this update is valid.

Co-authored-by: Mossaka <[email protected]>

Copilot · 2026-01-06T18:30:47Z

@copilot add more integration tests and to smoke tests to verify that this update is valid.

Added comprehensive integration tests and smoke tests in commit fab5374:

Integration Tests (pkg/workflow/blocked_domains_integration_test.go):

5 new tests covering blocked domains compilation for Copilot, Claude, and Codex engines
Tests verify --block-domains flag appears correctly in compiled workflows
Tests verify ecosystem identifier expansion (e.g., python → pypi.org, files.pythonhosted.org)
All tests passing ✅

Smoke Test Workflows (pkg/cli/workflows/test-*-blocked-domains.md):

test-copilot-blocked-domains.md - Blocks PyPI domains while allowing GitHub
test-claude-blocked-domains.md - Blocks NPM domains while allowing GitHub
test-codex-blocked-domains.md - Blocks custom example domains while allowing GitHub

Each smoke test validates:

Allowed domains are accessible
Blocked domains are actually blocked by AWF
GitHub MCP server works correctly
File operations succeed

Fixed critical bug: Added blocked domains extraction in frontmatter_extraction_security.go - the parser wasn't reading the blocked field from YAML, so blocked domains weren't being applied during compilation.

github-actions · 2026-01-06T19:55:51Z

🎬 THE END — Smoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨

github-actions · 2026-01-06T19:55:52Z

🎉 Yo ho ho! Changeset Generator found the treasure and completed successfully! ⚓💰

github-actions · 2026-01-06T19:55:52Z

💀 Blimey! Smoke Copilot Safe Inputs failed and walked the plank! No treasure today, matey! ☠️

github-actions · 2026-01-06T22:29:19Z

✅ Firewall validation complete... Smoke Codex Firewall confirmed network sandboxing is operational. 🛡️

github-actions · 2026-01-06T22:29:21Z

🎬 THE END — Smoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨

github-actions · 2026-01-06T22:29:21Z

🎉 Yo ho ho! Changeset Generator found the treasure and completed successfully! ⚓💰

github-actions · 2026-01-06T22:29:22Z

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

github-actions · 2026-01-06T22:29:22Z

📰 VERDICT: Smoke Copilot Playwright has concluded. All systems operational. This is a developing story. 🎤

github-actions · 2026-01-06T22:29:24Z

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

github-actions · 2026-01-06T22:29:24Z

🎉 Yo ho ho! Smoke Copilot Safe Inputs found the treasure and completed successfully! ⚓💰

github-actions · 2026-01-06T22:29:25Z

🤖 DIAGNOSTIC COMPLETE: Smoke Copilot No Firewall STATUS: ALL_UNITS_OPERATIONAL. MISSION_SUCCESS.

github-actions · 2026-01-06T22:31:07Z

Smoke Test Results

Last 2 Merged PRs:

Replace awmg with gh-aw-mcpg as MCP gateway #9171 Replace awmg with gh-aw-mcpg as MCP gateway (@Mossaka)
[instructions] Sync github-agentic-workflows.md with v0.35.1 #9168 [instructions] Sync github-agentic-workflows.md with v0.35.1

Test Results:
✅ GitHub MCP (list PRs)
✅ File Writing (/tmp/gh-aw/agent/)
✅ Bash Tool (cat verification)
✅ GitHub MCP Default Toolset (get_me correctly unavailable)
✅ Cache Memory (/tmp/gh-aw/cache-memory/)
✅ Web Fetch (GitHub API)

Overall: PASS

AI generated by Smoke Copilot

github-actions · 2026-01-06T22:31:19Z

Smoke Test Results

✅ File Writing Test: Created /tmp/gh-aw/agent/smoke-test-copilot-20764118994.txt
✅ Bash Tool Test: File verified successfully
✅ Safe Input gh Tool Test: Tool unavailable (as expected without safe-inputs enabled)

Status: PASS - All core functionality working correctly

AI generated by Smoke Copilot Safe Inputs

github-actions · 2026-01-06T22:31:37Z

Smoke Test Results - Copilot Engine (No Firewall)

Run ID: 20764118990
Date: 2026-01-06T22:30:16Z

Test Results

✅ Last 2 Merged PRs: Retrieved successfully (PR #9168, PR #9163)
✅ File Creation: Created /tmp/gh-aw/agent/smoke-test-copilot-20764118990.txt
✅ Playwright Navigation: Navigated to https://github.com successfully (Title: "GitHub · Change is constant. GitHub keeps you ahead. · GitHub")
✅ GitHub Issues: Listed 3 open issues (#9127, #9122, #9101)

All tests passed successfully.

AI generated by Smoke Copilot No Firewall

github-actions · 2026-01-06T22:31:40Z

Smoke Test Results

✅ Cache Memory: Successfully wrote and verified test file
❌ Playwright MCP: Tool execution failed (npx command issue)
✅ GitHub CLI: Successfully accessed issue list

Overall Status: PARTIAL PASS (2/3 tests passed)

AI generated by Smoke Copilot Playwright

github-actions · 2026-01-06T22:31:48Z

PRs: [instructions] Sync github-agentic-workflows.md with v0.35.1; Bump gh-aw-firewall (AWF) to v0.8.2
OpenAI curl blocked: ✅
GitHub MCP fetch merged PRs: ✅
File write/read /tmp/gh-aw/agent/smoke-test-codex-firewall-20764118997.txt: ✅
example.com curl blocked: ✅
Network: SANDBOXED
Overall: PASS

AI generated by Smoke Codex Firewall

github-actions · 2026-01-06T22:32:03Z

Recent merged PRs:

[instructions] Sync github-agentic-workflows.md with v0.35.1
Bump gh-aw-firewall (AWF) to v0.8.2
GitHub MCP: ✅
File write/read (/tmp/gh-aw/agent): ✅
Playwright title check: ✅
Cache memory write/read: ✅
safeinputs-gh gh issues list: ❌ (command not found)
Overall: FAIL

AI generated by Smoke Codex

github-actions · 2026-01-06T22:32:14Z

Smoke Test Results - Claude Engine

Recent PRs:

Replace awmg with gh-aw-mcpg as MCP gateway #9171: Replace awmg with gh-aw-mcpg as MCP gateway
[instructions] Sync github-agentic-workflows.md with v0.35.1 #9168: [instructions] Sync github-agentic-workflows.md with v0.35.1

Test Results:
✅ GitHub MCP - Retrieved 2 merged PRs successfully
✅ File Writing - Created /tmp/gh-aw/agent/smoke-test-claude-20764118971.txt
✅ Bash Tool - Verified file creation via cat
✅ Playwright MCP - Navigated to GitHub, page title contains "GitHub"
✅ Cache Memory - Created and verified /tmp/gh-aw/cache-memory/smoke-test-20764118971.txt
❌ Safe Input gh Tool - Tool not available in environment

Overall Status: PASS (5/6 tests passed, 1 tool unavailable)

AI generated by Smoke Claude

Initial plan

a11c565

Copilot AI assigned Copilot and mnkiefer Jan 6, 2026

Copilot started work on behalf of mnkiefer January 6, 2026 02:33 View session

Copilot AI and others added 3 commits January 6, 2026 02:41

Add blocked domains support to network permissions

c3407b7

Co-authored-by: mnkiefer <[email protected]>

Complete blocked domains implementation with tests and documentation

c53e676

Co-authored-by: mnkiefer <[email protected]>

Add example workflow demonstrating blocked domains feature

29c385a

Co-authored-by: mnkiefer <[email protected]>

Copilot AI changed the title ~~[WIP] Add domain blocklist support~~ Add domain blocklist support via --block-domains flag Jan 6, 2026

Copilot AI requested a review from mnkiefer January 6, 2026 02:59

Copilot finished work on behalf of mnkiefer January 6, 2026 02:59

pelikhan reviewed Jan 6, 2026

View reviewed changes

Copilot started work on behalf of pelikhan January 6, 2026 03:04 View session

Move example-blocked-domains workflow to pkg/cli/workflows

9f7de6f

Co-authored-by: pelikhan <[email protected]>

Copilot AI requested a review from pelikhan January 6, 2026 03:07

Copilot finished work on behalf of pelikhan January 6, 2026 03:07

pelikhan assigned Mossaka and unassigned mnkiefer Jan 6, 2026

Copilot started work on behalf of Mossaka January 6, 2026 18:19 View session

Add blocked domains extraction and comprehensive integration/smoke tests

fab5374

Co-authored-by: Mossaka <[email protected]>

Mossaka marked this pull request as ready for review January 6, 2026 18:31

Merge branch 'main' into copilot/add-domain-blocklist-support

24bacba

Copilot AI requested a review from Mossaka January 6, 2026 18:32

Copilot finished work on behalf of Mossaka January 6, 2026 18:32

Mossaka added the smoke label Jan 6, 2026

Merge branch 'main' into copilot/add-domain-blocklist-support

9c7a2c5

Copilot finished work on behalf of Mossaka January 6, 2026 22:23

Mossaka added smoke and removed smoke smoke-claude smoke-copilot-no-firewall smoke-codex-firewall labels Jan 6, 2026

github-actions bot added the smoke-copilot label Jan 6, 2026

github-actions bot added the smoke-copilot-no-firewall label Jan 6, 2026

github-actions bot added the smoke-codex-firewall label Jan 6, 2026

Add changeset [skip-ci]

cc967c5

github-actions bot added the smoke-claude label Jan 6, 2026

Merge branch 'main' into copilot/add-domain-blocklist-support

da6a17b

Mossaka merged commit b80e7de into main Jan 7, 2026
45 of 47 checks passed

Mossaka deleted the copilot/add-domain-blocklist-support branch January 7, 2026 15:58

github-actions bot mentioned this pull request Jan 7, 2026

[docs] Add branch-prefix documentation for repo-memory (Jan 7, 2026) #9266

Merged

Add domain blocklist support via --block-domains flag #9063

Add domain blocklist support via --block-domains flag #9063

Conversation

Copilot AI commented Jan 6, 2026 • edited by agentic-workflows-dev bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!