Skip to content

Commit a981e31

Browse files
Copilotpelikhan
Copilot
and
pelikhan
committed
Fix computeAllowedDomainsForSanitization to use WithToolsAndRuntimes for all engines
All engine cases now call the WithToolsAndRuntimes variant for consistency with the actual engine execution code (copilot_engine_execution.go, codex_engine.go, claude_engine.go, gemini_engine.go), ensuring tool MCP domains and runtime ecosystem domains are included in sanitization. Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
1 parent db25fc3 commit a981e31

2 files changed

Lines changed: 6 additions & 12 deletions

File tree

‎.github/workflows/smoke-gemini.lock.yml‎

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎pkg/workflow/domains.go‎

Lines changed: 5 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -684,21 +684,15 @@ func (c *Compiler) computeAllowedDomainsForSanitization(data *WorkflowData) stri
684684
engineID = data.AI
685685
}
686686

687-
// Compute domains based on engine type
688-
// For Copilot with firewall support, use GetCopilotAllowedDomains which merges
689-
// Copilot defaults with network permissions
690-
// For Codex with firewall support, use GetCodexAllowedDomains which merges
691-
// Codex defaults with network permissions
692-
// For Claude with firewall support, use GetClaudeAllowedDomains which merges
693-
// Claude defaults with network permissions
694-
// For other engines, use GetAllowedDomains which uses network permissions only
687+
// Compute domains based on engine type, including tools and runtimes to match
688+
// what's provided to the actual firewall at runtime
695689
switch engineID {
696690
case "copilot":
697-
return GetCopilotAllowedDomains(data.NetworkPermissions)
691+
return GetCopilotAllowedDomainsWithToolsAndRuntimes(data.NetworkPermissions, data.Tools, data.Runtimes)
698692
case "codex":
699-
return GetCodexAllowedDomains(data.NetworkPermissions)
693+
return GetCodexAllowedDomainsWithToolsAndRuntimes(data.NetworkPermissions, data.Tools, data.Runtimes)
700694
case "claude":
701-
return GetClaudeAllowedDomains(data.NetworkPermissions)
695+
return GetClaudeAllowedDomainsWithToolsAndRuntimes(data.NetworkPermissions, data.Tools, data.Runtimes)
702696
case "gemini":
703697
return GetGeminiAllowedDomainsWithToolsAndRuntimes(data.NetworkPermissions, data.Tools, data.Runtimes)
704698
default:

0 commit comments

Comments
 (0)