feat: enable firewall on claude and remove hooks" by Mossaka · Pull Request #4792 · github/gh-aw

Mossaka · 2025-11-26T00:28:47Z

feat: enable firewall on claude engine ana remove hooks
update the awf to v0.4.0

Smoke Test: Copilot Engine (No Firewall)

Timestamp: 2025-11-28 00:31 UTC
Status: PASS ✅
All core functionalities validated: GitHub MCP, file writing, bash tools, and Playwright MCP.

AI generated by Smoke Copilot No Firewall

Changeset

Type: patch
Description: Enable firewall on the Claude engine, remove obsolete hooks, and update AWF to v0.4.0.

AI generated by Changeset Generator

Smoke Test Summary (Run 19878489061)

Timestamp: 2025-12-03T00:51:48Z
Status: PASS
All core functionality validated: GitHub MCP, file operations, bash execution, and Playwright browser automation.

AI generated by Smoke Copilot No Firewall

Changeset

Type: patch
Description: Enable firewall on the Claude engine, remove obsolete hooks, and update AWF to v0.4.0.

AI generated by Changeset Generator

Smoke Test Summary

Test Run: 2025-12-03T01:12:23Z
Status: PASS
Summary: All tools validated - GitHub MCP, file operations, bash execution, and Playwright browser automation working correctly.

AI generated by Smoke Copilot No Firewall

github-actions · 2025-11-26T00:29:44Z

✅ Agentic Changeset Generator completed successfully.

Copilot

Pull request overview

This pull request enables firewall support for the Claude engine and removes the legacy network permissions hooks system. The changes replace the hook-based approach (which used Python scripts and Claude settings.json) with the AWF (Agentic Workflows Firewall) binary approach that was previously only available for the Copilot engine. Additionally, the AWF version is updated from v0.3.0 to v0.4.0.

Key changes:

Claude engine now supports AWF firewall (matching Copilot's capabilities)
Removed deprecated hooks-based network permissions system
Updated enableFirewallByDefault to use engine interface instead of string-based engine ID
Added GetClaudeAllowedDomains helper function for Claude-specific domain handling
Updated all tests to reflect Claude's new firewall support

Reviewed changes

Copilot reviewed 66 out of 66 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
`pkg/workflow/claude_engine.go`	Enabled firewall support flag; removed hooks/settings generation; added AWF wrapper logic in GetExecutionSteps; implemented GetSquidLogsSteps
`pkg/workflow/firewall.go`	Refactored `enableFirewallByDefault` to accept engine interface and check `SupportsFirewall()` method
`pkg/workflow/domains.go`	Added `GetClaudeAllowedDomains` function for Claude-specific domain handling (similar to Copilot's)
`pkg/workflow/compiler.go`	Updated call to `enableFirewallByDefault` to pass engine instead of engine ID string
`pkg/constants/constants.go`	Updated DefaultFirewallVersion from v0.3.0 to v0.4.0
`pkg/workflow/engine_firewall_support_test.go`	Updated tests to verify Claude now supports firewall
`pkg/workflow/firewall_default_enablement_test.go`	Updated tests to use engine instances; added Claude firewall tests
`pkg/workflow/firewall_workflow_test.go`	Updated tests to expect AWF installation instead of hooks for Claude
`pkg/workflow/claude_engine_network_test.go`	Updated all tests to expect AWF wrapper instead of settings/hooks
`pkg/workflow/network_test.go`	Removed deprecated test for `HasNetworkPermissions`
`pkg/workflow/agentic_output_test.go`	Removed tests for Claude hooks cleanup (no longer needed)
`pkg/workflow/claude_settings.go`	Deleted (hooks-based settings no longer used)
`pkg/workflow/claude_settings_test.go`	Deleted (tests for deleted functionality)
`pkg/workflow/claude_settings_tmp_test.go`	Deleted (tests for deleted functionality)
`pkg/workflow/engine_network_hooks.go`	Deleted (hooks system no longer used)
`pkg/workflow/engine_network_test.go`	Deleted (tests for deleted functionality)
`.github/workflows/*.lock.yml`	All compiled workflows updated to use AWF v0.4.0 and remove hooks generation steps

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

pelikhan · 2025-11-26T00:31:27Z

@copilot Claude agentic engine should be updated to reflect that it supports network firewall.

Copilot · 2025-11-26T00:31:41Z

@pelikhan I've opened a new pull request, #4794, to work on those changes. Once the pull request is ready, I'll request review from you.

Mossaka · 2025-11-26T00:31:17Z

+ "actions/github-script@v7": {
+ "repo": "actions/github-script",
+ "version": "v7",
+ "sha": "f28e40c7f34bde8b3046d885e986cb6290c5673b"
+ },


@copilot remove github-script@v7 from this branch

Mossaka · 2025-11-26T00:31:37Z

+ "actions/github-script@v7": {
+ "repo": "actions/github-script",
+ "version": "v7",
+ "sha": "f28e40c7f34bde8b3046d885e986cb6290c5673b"
+ },


@copilot remove github-script@v7 from this pr

Copilot · 2025-11-26T00:31:53Z

@Mossaka I've opened a new pull request, #4795, to work on those changes. Once the pull request is ready, I'll request review from you.

github-actions · 2025-11-26T20:47:05Z

✅ Agentic Changeset Generator completed successfully.

Mossaka · 2025-11-26T21:09:00Z

@copilot can you figure out why the integration test is failing and can you fix it? https://github.com/githubnext/gh-aw/actions/runs/19717073693/job/56491771896?pr=4792

github-actions · 2025-11-26T21:09:00Z

✅ Agentic Changeset Generator completed successfully.

Copilot · 2025-11-26T21:09:10Z

@Mossaka I've opened a new pull request, #4884, to work on those changes. Once the pull request is ready, I'll request review from you.

github-actions · 2025-11-27T00:30:19Z

❌ Agentic Smoke Copilot failed and wasn't able to produce a result.

github-actions · 2025-11-27T00:30:19Z

Agentic Smoke Codex triggered by this pull request.

github-actions · 2025-11-27T00:30:20Z

Agentic Smoke Copilot No Firewall triggered by this pull request.

github-actions · 2025-12-03T00:53:05Z

Smoke Test Results

Timestamp: 2025-12-03T00:51:48Z

✅ GitHub MCP: Last 2 PRs retrieved (Convert embedded custom agents to prompt file format #5337, refactor: rename to firewall-escape.md, add 80% novelty requirement, and increase timeout #4789)
✅ File Writing: Created /tmp/gh-aw/agent/smoke-test-copilot-19878489061.txt
✅ Bash Tool: Verified file creation
✅ Playwright MCP: Navigated to github.com, title contains "GitHub"

Overall Status: PASS

🤖 DIAGNOSTIC REPORT GENERATED BY Smoke Copilot No Firewall fer issue #4792 🗺️

github-actions · 2025-12-03T00:53:34Z

Convert embedded custom agents to prompt file format
refactor: rename to firewall-escape.md, add 80% novelty requirement, and increase timeout
GitHub MCP test ✅
File write test ✅ (/tmp/gh-aw/agent/smoke-test-codex-19878489043.txt)
Bash cat test ✅
Playwright title test ✅
Overall: PASS

🔮 The oracle has spoken through Smoke Codex fer issue #4792 🗺️

github-actions · 2025-12-03T00:53:35Z

Smoke Test Results: Copilot Engine + Playwright

✅ Playwright Navigation: Successfully navigated to https://github.com
✅ Page Title Verification: Confirmed title contains "GitHub"

Overall Status: ✅ PASS

📰 BREAKING: Report filed by Smoke Copilot Playwright fer issue #4792 🗺️

pelikhan · 2025-12-03T00:56:17Z

Too old.

Signed-off-by: Jiaxiao (mossaka) Zhou <duibao55328@gmail.com>

Mossaka · 2025-12-03T01:02:37Z

Oh wait, I am working on this one!

github-actions · 2025-12-03T01:10:45Z

🔮 The ancient spirits stir... Smoke Codex awakens to divine this pull request...

github-actions · 2025-12-03T01:10:46Z

💫 TO BE CONTINUED...Smoke Claude failed! Our hero faces unexpected challenges...

github-actions · 2025-12-03T01:10:47Z

🤖 SYSTEM_INIT: Smoke Copilot No Firewall ACTIVATED. PROCESSING pull request. ALL SUBSYSTEMS ONLINE.

github-actions · 2025-12-03T01:10:49Z

📰 BREAKING: Smoke Copilot Playwright is now investigating this pull request. Sources say the story is developing...

github-actions · 2025-12-03T01:10:49Z

🎉 Yo ho ho! Changeset Generator found the treasure and completed successfully! ⚓💰

github-actions · 2025-12-03T01:10:50Z

📰 DEVELOPING STORY: Smoke Copilot reports failed. Our correspondents are investigating the incident...

github-actions · 2025-12-03T01:13:45Z

Smoke Test Results (Copilot - No Firewall)

Last 2 Merged PRs:

Migrate workflow commands (run, status, logs, audit) to RunE #5329: Migrate workflow commands (run, status, logs, audit) to RunE
Add safe output for assigning users to issues #5333: Add safe output for assigning users to issues

Test Results:

✅ GitHub MCP: Retrieved recent merged PRs
✅ File Writing: Created test file successfully
✅ Bash Tool: Verified file content
✅ Playwright: Navigated to GitHub, title verified

Overall: PASS

🤖 DIAGNOSTIC REPORT GENERATED BY Smoke Copilot No Firewall fer issue #4792 🗺️

github-actions · 2025-12-03T01:14:00Z

Migrate workflow commands (run, status, logs, audit) to RunE
Convert embedded custom agents to prompt file format
✅ GitHub MCP review
✅ File write + cat
✅ Playwright title check
Overall: PASS

🔮 The oracle has spoken through Smoke Codex fer issue #4792 🗺️

github-actions · 2025-12-03T01:14:07Z

Smoke Test Results

✅ Playwright Navigation: Successfully navigated to https://github.com
✅ Page Title Validation: Title contains "GitHub" ✓

Overall Status: PASS

📰 BREAKING: Report filed by Smoke Copilot Playwright fer issue #4792 🗺️

Mossaka · 2025-12-03T23:45:01Z

This PR will be blocked by a new release of awf that supports user mode

pelikhan · 2025-12-11T16:43:05Z

stale, reopen when ready

CopilotAI review requested due to automatic review settings November 26, 2025 00:28

Mossaka added smoke changeset labels Nov 26, 2025

Copilotstarted reviewing on behalf of Mossaka November 26, 2025 00:29 View session

Copilotfinished reviewing on behalf of Mossaka November 26, 2025 00:30

CopilotAI reviewed Nov 26, 2025
View reviewed changes

CopilotAI mentioned this pull request Nov 26, 2025
feat: enable firewall on claude and remove hooks #4794
Closed

Mossaka commented Nov 26, 2025
View reviewed changes

CopilotAI mentioned this pull request Nov 26, 2025
Remove github-script@v7 from actions-lock.json #4795
Merged

Mossaka force-pushed the firewall-claude branch from 5be6c9a to de259edCompare November 26, 2025 20:38

Mossaka added smoke and removed smoke labels Nov 26, 2025

Mossaka added smoke and removed smoke changeset labels Nov 26, 2025

CopilotAI mentioned this pull request Nov 26, 2025
[WIP] Fix firewall implementation on claude and update dependencies #4884
Merged
4 tasks

Mossaka force-pushed the firewall-claude branch from 2f2b0f6 to e7289bfCompare November 27, 2025 00:13

Mossaka added smoke and removed smoke labels Nov 27, 2025

Add changeset [skip-ci]
78eb6b8

pelikhan closed this Dec 3, 2025

github-actionsBot mentioned this pull request Dec 3, 2025
Add assign-to-user safe output type #5340
Merged
24 tasks

add tty and define default domains for operation
2e24818
Signed-off-by: Jiaxiao (mossaka) Zhou <duibao55328@gmail.com>

Mossaka added smoke and removed smoke labels Dec 3, 2025

Mossaka reopened this Dec 3, 2025

Merge branch 'main' into firewall-claude
63bcd2a

Mossaka added smoke and removed smoke labels Dec 3, 2025

Add changeset for PR#4792: enable firewall on Claude [skip-ci]
4189b20

pelikhan closed this Dec 11, 2025

github-actionsBot mentioned this pull request Dec 11, 2025
Enable GH_DEBUG for gh CLI commands in shared/gh.md safe-input tool #6152
Merged

pelikhan deleted the firewall-claude branch December 15, 2025 04:49

Uh oh!

Conversation

Mossaka commented Nov 26, 2025• edited by github-actions BotLoading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Smoke Test: Copilot Engine (No Firewall)

Changeset

Smoke Test Summary (Run 19878489061)

Changeset

Smoke Test Summary

Uh oh!

github-actionsBot commented Nov 26, 2025• edited by agentic-workflows-dev BotLoading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

pelikhan commented Nov 26, 2025

Uh oh!

CopilotAI commented Nov 26, 2025

Uh oh!

MossakaNov 26, 2025

Choose a reason for hiding this comment

Uh oh!

MossakaNov 26, 2025

Choose a reason for hiding this comment

Uh oh!

CopilotAI commented Nov 26, 2025

Uh oh!

github-actionsBot commented Nov 26, 2025• edited by agentic-workflows-dev BotLoading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Mossaka commented Nov 26, 2025

Uh oh!

github-actionsBot commented Nov 26, 2025• edited by agentic-workflows-dev BotLoading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

CopilotAI commented Nov 26, 2025

Uh oh!

github-actionsBot commented Nov 27, 2025• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actionsBot commented Nov 27, 2025

Uh oh!

github-actionsBot commented Nov 27, 2025

Uh oh!

github-actionsBot commented Dec 3, 2025

Smoke Test Results

Uh oh!

github-actionsBot commented Dec 3, 2025

Uh oh!

github-actionsBot commented Dec 3, 2025

Smoke Test Results: Copilot Engine + Playwright

Uh oh!

pelikhan commented Dec 3, 2025

Uh oh!

Mossaka commented Dec 3, 2025

Uh oh!

github-actionsBot commented Dec 3, 2025

Uh oh!

github-actionsBot commented Dec 3, 2025• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actionsBot commented Dec 3, 2025

Uh oh!

github-actionsBot commented Dec 3, 2025

Uh oh!

github-actionsBot commented Dec 3, 2025• edited by agentic-workflows-dev BotLoading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actionsBot commented Dec 3, 2025• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actionsBot commented Dec 3, 2025

Smoke Test Results (Copilot - No Firewall)

Uh oh!

github-actionsBot commented Dec 3, 2025

Uh oh!

github-actionsBot commented Dec 3, 2025

Mossaka commented Nov 26, 2025•
edited by github-actions Bot
Loading

github-actionsBot commented Nov 26, 2025•
edited by agentic-workflows-dev Bot
Loading

github-actionsBot commented Nov 26, 2025•
edited by agentic-workflows-dev Bot
Loading

github-actionsBot commented Nov 26, 2025•
edited by agentic-workflows-dev Bot
Loading

github-actionsBot commented Nov 27, 2025•
edited
Loading

github-actionsBot commented Dec 3, 2025•
edited
Loading

github-actionsBot commented Dec 3, 2025•
edited by agentic-workflows-dev Bot
Loading

github-actionsBot commented Dec 3, 2025•
edited
Loading