Remove tools.playwright allowed_domains/allowed_hosts; add codemod to migrate to network.allowed by Copilot · Pull Request #17629 · github/gh-aw

Copilot · 2026-02-22T00:49:05Z

Original prompt

Remove tools.playwright allowed-hosts and allowed-domains. The egress is controlled by the firewall.
Add codemod to move existing domains to network.firewall

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

… migrate to network.allowed Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot

Pull request overview

This PR removes the deprecated tools.playwright.allowed_domains configuration field and migrates egress control to the unified workflow firewall (network.allowed). This simplifies the Playwright tool configuration by eliminating redundant network control mechanisms.

Changes:

Removed allowed_domains field and related types (PlaywrightDomain, PlaywrightAllowedDomains) from Playwright tool configuration
Removed generation of --allowed-hosts and --allowed-origins flags from both TOML and JSON MCP renderers
Added codemod playwright-allowed-domains-migration (v0.9.0) to automatically migrate existing configurations
Updated 6 workflow files to remove redundant allowed_domains entries (already covered by network.allowed)

Reviewed changes

Copilot reviewed 37 out of 37 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
pkg/workflow/tools_types.go	Removed PlaywrightDomain, PlaywrightAllowedDomains types and AllowedDomains field from PlaywrightToolConfig
pkg/workflow/tools_parser.go	Removed parsing logic for allowed_domains field in Playwright configuration
pkg/workflow/tools_types_test.go	Updated tests to remove allowed_domains from test data
pkg/workflow/mcp_renderer.go	Removed generation of --allowed-hosts/--allowed-origins flags from TOML renderer
pkg/workflow/mcp_config_playwright_renderer.go	Removed domain handling and flag generation from JSON renderer; updated documentation
pkg/workflow/mcp_playwright_config.go	Removed generatePlaywrightAllowedDomains function and AllowedDomains from PlaywrightDockerArgs
pkg/workflow/mcp_environment.go	Updated to extract expressions only from custom args, not allowed_domains
pkg/workflow/mcp_config_validation.go	Removed allowed_domains and allowed-domains from known Playwright fields
pkg/workflow/codex_engine.go	Removed AllowedDomains field from Playwright config creation
pkg/workflow/sandbox_validation.go	Updated example to show playwright: null instead of allowed_domains configuration
pkg/parser/schemas/main_workflow_schema.json	Removed allowed_domains property from Playwright tool schema
pkg/parser/mcp.go	Removed allowed_domains handling and PLAYWRIGHT_ALLOWED_DOMAINS env var from MCP parser
pkg/cli/codemod_playwright_domains.go	New codemod to migrate allowed_domains to network.allowed
pkg/cli/codemod_playwright_domains_test.go	Comprehensive tests for the migration codemod
pkg/cli/fix_codemods.go	Registered the new codemod
pkg/workflow/playwright_mcp_integration_test.go	Updated tests to verify flags are NOT present; removed TestPlaywrightNPXCommandWorks
pkg/workflow/playwright_allowed_domains_secrets_test.go	Removed tests for allowed_domains secret handling; kept tests for custom args
pkg/cli/mcp_inspect_playwright_*.go	Removed allowed_domains from test configurations
pkg/workflow/mcp_benchmark_test.go	Removed allowed_domains from benchmark test data
.github/workflows/*.md	Removed redundant allowed_domains from 6 workflow files
.github/workflows/*.lock.yml	Updated lock files to reflect removal of --allowed-hosts/--allowed-origins flags

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-02-22T03:54:07Z

@@ -447,34 +446,8 @@ func processBuiltinMCPTool(toolName string, toolValue any, serverFilter string)
 Name: "playwright",
 }


The removal of allowed_domains handling here is correct, but the corresponding tests in pkg/parser/mcp_test.go (lines 254-387) were not updated. These tests still expect PLAYWRIGHT_ALLOWED_DOMAINS environment variable to be set based on the allowed_domains configuration, which is now incorrect behavior. The tests should be updated to remove the allowed_domains field from test inputs and remove expectations of the PLAYWRIGHT_ALLOWED_DOMAINS environment variable.

Fixed in 24c341c. Updated pkg/parser/mcp_test.go to remove allowed_domains from all Playwright test inputs, remove the PLAYWRIGHT_ALLOWED_DOMAINS env var from expected Args/Env, and merged the now-redundant "localhost default" test case into the renamed "default configuration" case.

Copilot · 2026-02-22T03:54:08Z

 config.Version = fmt.Sprintf("%g", versionNum)
 }



Multiple test files contain test data with allowed_domains field for Playwright configurations that should be updated to reflect the removal of this field. While these tests will still pass (the field is silently ignored by the parser), keeping outdated test data is misleading. The affected test files include:
pkg/workflow/args_field_test.go (lines 55, 69, 83)
pkg/workflow/version_field_test.go (lines 67, 78, 88, 99, 110)
pkg/workflow/http_mcp_domains_test.go (lines 65, 248, 309, 329)
pkg/workflow/mcp_config_shared_test.go (lines 160, 181, 210)
pkg/workflow/importable_tools_test.go (lines 29, 286, 455)
pkg/workflow/strict_mode_test.go (line 171)
pkg/workflow/mcp_logs_upload_test.go (line 24)
pkg/workflow/shared_workflow_test.go (line 27)
These test files should be updated to remove allowed_domains from Playwright test configurations to accurately represent the new behavior.

Fixed in 24c341c. Removed allowed_domains from test data in all 8 listed test files, updated the WASM golden fixture (smoke-copilot.md) and regenerated its golden output file, and cleaned up the two pkg/cli/workflows/ test workflow files as well.

pelikhan · 2026-02-22T03:55:24Z

@copilot fix build wasm https://github.com/github/gh-aw/actions/runs/22267997492/job/64422594247

…ata and update expectations Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-02-22T04:05:23Z

@copilot fix build wasm https://github.com/github/gh-aw/actions/runs/22267997492/job/64422594247

Fixed in 24c341c. The WASM golden test was failing because smoke-copilot.md fixture still had allowed_domains. Removed it from the fixture and regenerated the golden output file — the --allowed-hosts/--allowed-origins flags no longer appear in the compiled output.

pelikhan · 2026-02-22T04:13:22Z

Fix tests https://github.com/github/gh-aw/actions/runs/22270101969/job/64423130685#step:9:1

pelikhan · 2026-02-22T04:13:50Z

@copilot fix tests https://github.com/github/gh-aw/actions/runs/22270101969/job/64423130685#step:9:1

…e allowed_domains assertions Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-02-22T04:22:19Z

@copilot fix tests https://github.com/github/gh-aw/actions/runs/22270101969/job/64423130685#step:9:1

Fixed in 2da792b. TestImportPlaywrightTool and TestImportAllThreeTools were asserting that example.com/github.com appeared in the compiled output — those values came from allowed_domains being passed as --allowed-hosts flags. With that mechanism removed, the assertions were stale and have been removed.

(The pkg/cli package-level failure in CI is TestFetchIncludeFromSource_SectionExtraction doing a real git clone to GitHub — unrelated to this PR, as remote_workflow_test.go was not touched.)

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

https://api.github.com/repos/actions/github-script/git/ref/tags/v8
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha 273226490/.github/workflows .cfg 64/pkg/tool/linux_amd64/vet (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha 1533603152/.github/workflows .cfg 64/pkg/tool/linux_amd64/vet (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/1/artifacts
- Triggering command: /usr/bin/gh gh run download 1 --dir test-logs/run-1 (http block)
- Triggering command: /usr/bin/gh gh run download 1 --dir test-logs/run-1 8465465/b214/vet.cfg ache/go/1.25.0/x64/pkg/tool/linux_amd64/vet (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/12345/artifacts
- Triggering command: /usr/bin/gh gh run download 12345 --dir test-logs/run-12345 (http block)
- Triggering command: /usr/bin/gh gh run download 12345 --dir test-logs/run-12345 5769931/b248/vet.cfg ache/go/1.25.0/x64/pkg/tool/linux_amd64/vet (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/12346/artifacts
- Triggering command: /usr/bin/gh gh run download 12346 --dir test-logs/run-12346 (http block)
- Triggering command: /usr/bin/gh gh run download 12346 --dir test-logs/run-12346 8465465/b207/vet.cfg ache/go/1.25.0/x64/pkg/tool/linux_amd64/vet (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/2/artifacts
- Triggering command: /usr/bin/gh gh run download 2 --dir test-logs/run-2 (http block)
- Triggering command: /usr/bin/gh gh run download 2 --dir test-logs/run-2 8465465/b208/vet.cfg ache/go/1.25.0/x64/pkg/tool/linux_amd64/vet (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/3/artifacts
- Triggering command: /usr/bin/gh gh run download 3 --dir test-logs/run-3 fuzz/counters_supported.go x_amd64/vet (http block)
- Triggering command: /usr/bin/gh gh run download 3 --dir test-logs/run-3 (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/4/artifacts
- Triggering command: /usr/bin/gh gh run download 4 --dir test-logs/run-4 (http block)
- Triggering command: /usr/bin/gh gh run download 4 --dir test-logs/run-4 8465465/b215/vet.cfg ache/go/1.25.0/x64/pkg/tool/linux_amd64/vet (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/5/artifacts
- Triggering command: /usr/bin/gh gh run download 5 --dir test-logs/run-5 (http block)
https://api.github.com/repos/github/gh-aw/actions/workflows
- Triggering command: /usr/bin/gh gh workflow list --json name,state,path (http block)
- Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 100 (http block)
- Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 6 (http block)
https://api.github.com/repos/nonexistent/repo/actions/runs/12345
- Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion (http block)
https://api.github.com/repos/owner/repo/actions/workflows
- Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo (http block)
- Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo 64/pkg/tool/linux_amd64/vet (http block)
https://api.github.com/repos/owner/repo/contents/file.md
- Triggering command: /tmp/go-build2125769931/b001/cli.test /tmp/go-build2125769931/b001/cli.test -test.paniconexit0 -test.timeout=10m0s -test.v=true -test.count=1 (http block)
- Triggering command: /tmp/go-build711484274/b001/cli.test /tmp/go-build711484274/b001/cli.test -test.paniconexit0 -test.v=true -test.count=1 -test.timeout=1m0s (http block)
- Triggering command: /tmp/go-build2065935528/b001/cli.test /tmp/go-build2065935528/b001/cli.test -test.testlogfile=/tmp/go-build2065935528/b001/testlog.txt -test.paniconexit0 -test.v=true -test.run=TestFetch -test.timeout=30s /tmp/go-build2125769931/b016/vetmain 5769931/b188/vet.cfg (http block)
https://api.github.com/repos/test-owner/test-repo/actions/secrets
- Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name (http block)
- Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name INVALID,NEW -j DROP (http block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

…ion addition (#17648)

Initial plan
259c3e6

CopilotAI assigned Copilot and pelikhan Feb 22, 2026

Copilotstarted work on behalf of pelikhan February 22, 2026 00:49 View session

This was referenced Feb 22, 2026
Smoke Test: Claude - 22267605985 #17633
Closed
Smoke Test: Copilot - 22267853624 #17634
Closed

Remove tools.playwright allowed_domains/allowed-hosts; add codemod to…
ec6eaf2
… migrate to network.allowed Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

CopilotAI changed the title ~~[WIP] Remove Playwright allowed-hosts and allowed-domains~~Remove tools.playwright allowed_domains/allowed_hosts; add codemod to migrate to network.allowedFeb 22, 2026

Copilotfinished work on behalf of pelikhan February 22, 2026 01:26

github-actionsBot mentioned this pull request Feb 22, 2026
[Contribution Check Report] Contribution Check — 2026-02-22 #17638
Closed

pelikhan marked this pull request as ready for review February 22, 2026 03:50

CopilotAI review requested due to automatic review settings February 22, 2026 03:50

Copilotstarted reviewing on behalf of pelikhan February 22, 2026 03:50 View session

CopilotAI reviewed Feb 22, 2026
View reviewed changes

Copilotstarted work on behalf of pelikhan February 22, 2026 03:55 View session

Fix tests and WASM golden fixture: remove allowed_domains from test d…
24c341c
…ata and update expectations Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilotfinished work on behalf of pelikhan February 22, 2026 04:05

Copilotstarted work on behalf of pelikhan February 22, 2026 04:13 View session

Fix TestImportPlaywrightTool and TestImportAllThreeTools: remove stal…
2da792b
…e allowed_domains assertions Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilotfinished work on behalf of pelikhan February 22, 2026 04:22

Fix codemod count/order tests after playwright-allowed-domains-migrat…
035220a
…ion addition (#17648)

pelikhan merged commit 792084b into mainFeb 22, 2026
48 checks passed

pelikhan deleted the copilot/remove-allowed-hosts-domains branch February 22, 2026 04:45

This was referenced Feb 22, 2026
feat(gemini): fix /tmp/ access and add neutral tool mapping for Gemini CLI settings #17642
Merged
[Daily Report] Daily Status Report — 2026-02-22 #17676
Closed

Navigation Menu

Uh oh!

Remove tools.playwright allowed_domains/allowed_hosts; add codemod to migrate to network.allowed - #17629

Remove tools.playwright allowed_domains/allowed_hosts; add codemod to migrate to network.allowed#17629
pelikhan merged 5 commits into
mainfrom
copilot/remove-allowed-hosts-domains

CopilotAI commented Feb 22, 2026•
edited
Loading

Uh oh!

CopilotAI left a comment

Uh oh!

CopilotAIFeb 22, 2026

Uh oh!

CopilotAIFeb 22, 2026

Uh oh!

CopilotAIFeb 22, 2026

Uh oh!

CopilotAIFeb 22, 2026

Uh oh!

pelikhan commented Feb 22, 2026

Uh oh!

CopilotAI commented Feb 22, 2026

Uh oh!

pelikhan commented Feb 22, 2026

Uh oh!

pelikhan commented Feb 22, 2026

Uh oh!

CopilotAI commented Feb 22, 2026•
edited
Loading

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		@@ -447,34 +446,8 @@ func processBuiltinMCPTool(toolName string, toolValue any, serverFilter string)
		Name: "playwright",
		}

Uh oh!

Conversation

CopilotAI commented Feb 22, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

CopilotAIFeb 22, 2026

Choose a reason for hiding this comment

Uh oh!

CopilotAIFeb 22, 2026

Choose a reason for hiding this comment

Uh oh!

CopilotAIFeb 22, 2026

Choose a reason for hiding this comment

Uh oh!

CopilotAIFeb 22, 2026

Choose a reason for hiding this comment

Uh oh!

pelikhan commented Feb 22, 2026

Uh oh!

CopilotAI commented Feb 22, 2026

Uh oh!

pelikhan commented Feb 22, 2026

Uh oh!

pelikhan commented Feb 22, 2026

Uh oh!

CopilotAI commented Feb 22, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

CopilotAI commented Feb 22, 2026•
edited
Loading

CopilotAI commented Feb 22, 2026•
edited
Loading