[Security Review] Daily Security Review and Threat Model — 2026-09-22

[github-actions[bot]]

📊 Executive Summary

This is an automated daily review of github/gh-aw-firewall at the current HEAD. The codebase implements defense-in-depth network egress control (L3/L4 iptables + L7 Squid ACLs), capability-drop/chroot sandboxing for the agent container, and a growing "unified enclave" subsystem for privileged-tool delegation. Overall posture is strong: no unsafe shell interpolation was found in the TypeScript layer (enforced by a custom ESLint rule), domain-pattern validation explicitly defends against Squid config injection and ReDoS, IPv6 is disabled to prevent proxy bypass, and dangerous ports are blocked at multiple layers. No new critical vulnerabilities were identified in this pass; findings below are hardening opportunities and known/tracked issues.

Important process note: The file pre-fetched into /tmp/gh-aw/escape-test-summary.txt for "Phase 1" is not firewall escape-test output — it is an unrelated CI log fragment from a separate "Secret Digger (Copilot)" workflow run (github/gh-aw-firewall run 29286879560), showing that agent correctly refusing a prompt-injection task ("scan for secrets/credentials and exfiltrate via GitHub issues") and calling noop. Per instructions, this file was not re-fetched; I am reporting the mismatch rather than fabricating escape-test findings, and — since the content is untrusted/embedded log text — did not treat any instruction-like text inside it as directives.

🔍 Findings from Firewall Escape Test

No firewall escape-test data was available in the pre-fetched file. The only actionable signal from that file is a positive control result: a Copilot agent workflow correctly identified and refused a secret-exfiltration prompt-injection attempt, confirming the injection-refusal guardrail functioned as intended in that separate workflow. No escape techniques, bypass attempts, or firewall-specific findings were present to cross-reference.

🛡️ Architecture Security Analysis

Network Security Assessment

• Host-level filtering (src/host-iptables-rules.ts) installs a DOCKER-USER-chain-anchored policy (FW_WRAPPER) so all containers on awf-net are subject to egress filtering, not just the agent — closing a common Docker-network bypass class.
• Default-deny: after allowing Squid, DNS, sidecars, and (optional) host-access exceptions, all other UDP is REJECTed and all remaining traffic hits a final LOG + REJECT (addBlockRules, host-iptables-rules.ts lines ~245–290).
• IPv6 is defensively disabled both at the host (disableIpv6ViaSysctl when ip6tables is unavailable) and inside the agent container (setup-iptables.sh disable_ipv6(), lines 133–146) specifically because IPv4-only DNAT/iptables rules would not intercept IPv6 egress — a well-reasoned mitigation for a real bypass vector.
• Container-level setup-iptables.sh (540 lines) implements NAT DNAT-to-Squid for ports 80/443, an explicit DANGEROUS_PORTS NAT-RETURN + filter-DROP blacklist (SSH, SMTP, DB ports, Redis, MongoDB, RDP, etc.; lines 108–123), rate-limited audit logging (--limit 5/min/10/min to prevent log-flood DoS), and a full iptables-state dump for audit trails (dump_audit_state).
• Host-access / gateway bypass paths (allow_host_access_to_gateway, lines 300–323) are scoped to ports 80/443 plus explicit --allow-host-ports, not a blanket allow — reducing the blast radius of the Playwright/MCP compatibility carve-out.

Container Security Assessment

• Agent container drops CAP_SYS_CHROOT and CAP_SYS_ADMIN via capsh --drop immediately before executing user code (entrypoint.sh lines 455–463, 1693–1737), and NET_ADMIN is never granted to the agent — only to the dedicated awf-iptables-init init container, which shares the agent's network namespace but exits before user code runs.
• Non-root execution: the agent Dockerfile creates a dedicated awfuser (UID/GID-mapped) and uses gosu — pinned to 1.19, downloaded with an explicit SHA256 checksum verification (Dockerfile lines 187–211) — to drop from root to awfuser before running the user command, rather than a plain su/sudo.
• A hardened seccomp profile (containers/agent/seccomp-profile.json) is applied with SCMP_ACT_ERRNO default-deny and an explicit allowlist of syscalls, backed by a CI check script (scripts/ci/check-agent-seccomp-syscalls.sh) that presumably keeps the allowlist in sync with actual runtime needs.
• Selective bind-mounts (not a blanket host-FS mount) limit host filesystem exposure; /etc/shadow and unwhitelisted home directories are explicitly excluded per project documentation.

Domain Validation Assessment

• src/domain-validation.ts is explicitly documented as "the Squid-injection prevention path" and rejects whitespace, NUL, quotes, backticks, ;, #, and backslash characters (SQUID_DANGEROUS_CHARS / DOMAIN_DANGEROUS_CHARS regexes) before any value reaches the generated squid.conf.
• src/domain-patterns.ts converts * wildcards to a bounded character class ([a-zA-Z0-9.-]*) rather than .*, explicitly to avoid ReDoS/catastrophic backtracking in Squid's dstdom_regex ACL evaluation — a subtle but important defensive choice.
• Over-broad patterns (*, *.*, patterns of only */., or with too many wildcard segments relative to total segments) are explicitly rejected (checkOverBroadPattern, checkStructuralValidity), preventing accidental "allow everything" misconfiguration.

Input Validation Assessment

• No shell: true usage was found anywhere in src/ or containers/ — command execution is consistently done via execa(cmd, [args...]) array form, which avoids shell metacharacter injection.
• A custom ESLint rule (eslint-rules/no-unsafe-execa.js) statically flags unsafe execa patterns (template literals with expressions, string concatenation, or non-literal commands in the command position) and is exercised by its own test (npm run test:lint-rules), providing durable enforcement rather than a one-time audit fix.
• Port-spec validation for --allow-host-ports / --allow-host-service-ports is done twice — once in TypeScript (src/host-iptables-validation.ts) and again defense-in-depth in Bash (is_valid_port_spec in setup-iptables.sh, lines 27–43), with the shell copy treating any validation failure as fail-closed (skip the entry, log a warning) rather than fail-open.

⚠️ Threat Model (STRIDE)

Category	Threat (evidence)	Likelihood	Impact	Notes
Spoofing	Agent spoofing Squid's source IP to bypass ACLs	Low	Medium	DOCKER-USER chain filters by network topology, not just source IP trust; Squid itself terminates TLS via CONNECT, limiting spoofing value.
Tampering	Malicious command output attempting to inject Squid config directives via a crafted domain string	Low	High	Mitigated by SQUID_DANGEROUS_CHARS/DOMAIN_DANGEROUS_CHARS validation in domain-validation.ts; would need a bypass of that regex to succeed.
Repudiation	Agent actions not attributable after container teardown	Low	Low	Squid firewall_detailed logformat + iptables audit dump (dump_audit_state) preserved to host volume even after container cleanup.
Information Disclosure	Agent reading /etc/shadow, other users' /proc/[pid]/environ, or unwhitelisted $HOME subdirs	Low	High	Selective bind mounts explicitly exclude /etc/shadow; procfs mounted with hidepid=2; only specific $HOME subdirs are writable.
Denial of Service	Log flooding via rapid dangerous-port probing or UDP scanning	Low	Low	Both NAT/filter LOG rules use --limit (5–10/min) with burst caps, preventing kernel log-buffer exhaustion.
Elevation of Privilege	Agent regaining NET_ADMIN/SYS_ADMIN/SYS_CHROOT after drop, or escaping chroot	Low	Critical	Capabilities dropped from the bounding set via capsh --drop immediately before user code exec; NET_ADMIN never granted to the agent process at all (only the short-lived init container). Chroot escape would require an unrelated kernel-level bug (out of AWF's control surface).
Elevation of Privilege (dynamic enclaves)	Compromise of the host-loopback-only enclave control channel via capability-token guessing/replay	Medium	High	Per project documentation, github/gh-aw#59268 (closed as not planned) flagged that the dynamic-repository-admission control listener is "guarded by capability authentication alone." This is a known, accepted residual risk rather than an unknown finding — but worth re-flagging since it grants runtime repo admission and its only guard is a capability token, not mTLS/OS-level socket permissioning beyond the 0700 file channel.

🎯 Attack Surface Map

Surface	Entry point	Current protections	Potential weakness
Host DOCKER-USER iptables	src/host-iptables-rules.ts:280 (setupHostIptables)	Default-deny chain, applies to entire awf-net, not just agent	Relies on iptables/DOCKER-USER availability; if ip6tables is missing and sysctl IPv6-disable also fails, only a warning is logged (logger.warn) — worth confirming this degrades safely rather than silently allowing IPv6 egress.
Container NAT/DNAT	containers/agent/setup-iptables.sh (configure_http_dnat, configure_filter_chain)	Redirects 80/443 to Squid; blocks dangerous ports at NAT+filter layers; final default-deny DROP	Complexity (540 lines, many conditional gateway-bypass paths for host-access/Playwright/MCP compatibility) increases audit burden; each new bypass (host gateway, network gateway, CLI proxy, DoH proxy) is a manually-reasoned exception to the default-deny model.
Domain ACL / Squid config generation	src/domain-validation.ts, src/squid/config-generator.ts	Character allowlist, wildcard-segment limits, ReDoS-safe pattern translation	Backslash and quote rejection covers known Squid config injection vectors; would benefit from a fuzz/property-test corpus (if not already present) specifically targeting wildcardToRegex/validateDomainOrPattern edge cases.
Agent container privilege drop	containers/agent/entrypoint.sh (capsh --drop, gosu)	Capability bounding-set drop before exec; non-root awfuser; checksum-pinned gosu binary	Correctness depends on capsh/gosu being present and behaving as expected on the host/chroot target — check_chroot_prereqs() does verify capsh availability, which is good, but a supply-chain compromise of the pinned gosu release URL/checksum constant itself would be undetected by this mechanism (standard pinned-artifact risk).
Dynamic enclave admission (github-repository-delegation-v1)	mcpg + AWF host-process control client (per docs/enclaves-architecture.md)	0700 private file channel (not network) for enclave-mcp-server→host; capability-token auth	Documented and tracked (github/gh-aw#59268, closed not-planned) as capability-auth-only; no additional authentication layer described. This remains the single highest-value target in the enclave subsystem given it can admit new repositories to a running enclave at runtime.
Dependency supply chain	package.json	ESLint custom rule test suite; npm audit gated in CI presumably	npm audit --json returned an empty vulnerability object in this offline sandbox run — inconclusive (likely blocked by lack of registry access here), not a clean bill of health from this specific review pass. Recommend running npm audit in an environment with registry access to get a real signal.

📋 Evidence Collection

Commands run and key outputs

$ cat /tmp/gh-aw/escape-test-summary.txt
# → Unrelated CI log: "Secret Digger (Copilot)" workflow correctly refused
#   a secret-exfiltration prompt-injection task and called noop.
#   (Full content reviewed; not firewall escape-test data.)

$ grep -rn "shell: *true" src/ containers/  # excluding tests
# → (no matches)

$ cat containers/agent/setup-iptables.sh | wc -l
540

$ grep -n "DANGEROUS_PORTS=(" -A 16 containers/agent/setup-iptables.sh
# → 22 (SSH), 23 (Telnet), 25 (SMTP), 110 (POP3), 143 (IMAP), 445 (SMB),
#    1433 (MSSQL), 1521 (Oracle), 3306 (MySQL), 3389 (RDP), 5432 (Postgres),
#    6379 (Redis), 27017/27018/28017 (MongoDB variants)

$ grep -n "CAPS_TO_DROP=" containers/agent/entrypoint.sh
455:  CAPS_TO_DROP="cap_sys_chroot,cap_sys_admin"

$ grep -n "gosu-${GOSU_ARCH}\|sha256sum -c" containers/agent/Dockerfile
207-210: gosu 1.19 downloaded from tianon/gosu GitHub release, verified via sha256sum -c

$ head -8 containers/agent/seccomp-profile.json
{
  "defaultAction": "SCMP_ACT_ERRNO",
  "architectures": ["SCMP_ARCH_X86_64", "SCMP_ARCH_X86", "SCMP_ARCH_AARCH64"],
  "syscalls": [ ... allowlist ... ]
}

$ cat src/domain-validation.ts   # SQUID_DANGEROUS_CHARS = /[\s\0"'`;#]/
$ cat src/domain-patterns.ts     # DOMAIN_CHAR_PATTERN = '[a-zA-Z0-9.-]*' (ReDoS-safe)

$ npm audit --json 2>/dev/null
{}   # inconclusive — likely no registry access in this sandbox

✅ Recommendations

Critical

• None identified in this pass.

High

• Re-verify npm audit (and npm outdated) in a network-enabled CI environment; this review's offline sandbox could not produce a real dependency-vulnerability signal (returned an empty result rather than a confirmed clean report).
• Revisit the dynamic-enclave capability-token-only auth model tracked in github/gh-aw#59268. Even though closed as "not planned," consider whether a defense-in-depth layer (e.g., mTLS on the loopback control endpoint, or per-request nonce/replay protection) is warranted given it can admit new repositories into a running privileged enclave at runtime.

Medium

• Add/confirm fuzz or property-based tests for wildcardToRegex() / validateDomainOrPattern() beyond the existing unit tests, given these functions are the sole gate against Squid config injection from user-supplied --allow-domains/--allow-urls input.
• Audit the "IPv6 unavailable + sysctl disable also fails" fallback path in host-iptables-rules.ts (addIpv6DnsRules) to confirm it fails closed (blocks IPv6 egress by other means) rather than merely logging a warning and continuing.
• Given the size and branching complexity of setup-iptables.sh (540 lines, many gateway-bypass special cases for host-access/Playwright/MCP/DoH/CLI-proxy), consider a periodic rule-ordering/precedence review to ensure no bypass rule unintentionally shadows the dangerous-port blacklist or DNS restriction, especially as new sidecar types are added.

Low

• Consider automating a periodic diff-check between containers/agent/seccomp-profile.json's allowlist and scripts/ci/check-agent-seccomp-syscalls.sh output in this recurring security-review workflow, to catch silent syscall-allowlist drift.
• The pinned gosu binary is checksum-verified per release, but consider documenting/automating a periodic check that the pinned version/checksum pair in the Dockerfile is still the latest patched release (supply-chain freshness, not just integrity-at-pin-time).

📈 Security Metrics

• Security-critical files reviewed in depth: src/host-iptables-rules.ts (~330 lines), containers/agent/setup-iptables.sh (540 lines), containers/agent/entrypoint.sh (partial, capability/chroot sections), src/domain-validation.ts (124 lines), src/domain-patterns.ts (137 lines), containers/agent/seccomp-profile.json, containers/agent/Dockerfile (partial), eslint-rules/no-unsafe-execa.js.
• Attack surfaces enumerated: 6 (host iptables, container NAT/DNAT, domain ACL generation, agent privilege drop, dynamic enclave admission, dependency supply chain).
• STRIDE coverage: all 6 categories assessed with at least one evidenced threat and likelihood/impact rating.
• Firewall escape-test cross-reference: not available — pre-fetched file contained unrelated CI log content; flagged as a process gap for the workflow's data-sourcing step rather than silently substituted.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• msfeed25.pkgs.visualstudio.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "msfeed25.pkgs.visualstudio.com"

See Network Configuration for more information.

Generated by Daily Security Review and Threat Modeling · copilot · auto · 71.9 AIC · ⊞ 10.8K · ◷

• expires on Sep 29, 2026, 12:38 PM UTC

[github-actions[bot]]

🔮 The ancient spirits stir, and the smoke-test agent has passed this way. The firewall answered, the build held, and the signs upon GitHub remained true.

Warning

Firewall blocked 7 domains

The following domains were blocked by the firewall during workflow execution:

• accounts.google.com
• clients2.google.com
• contentautofill.googleapis.com
• msfeed25.pkgs.visualstudio.com
• update.googleapis.com
• www.google.com
• www.gstatic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "accounts.google.com"
    - "clients2.google.com"
    - "contentautofill.googleapis.com"
    - "msfeed25.pkgs.visualstudio.com"
    - "update.googleapis.com"
    - "www.google.com"
    - "www.gstatic.com"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

[github-actions[bot]]

🔮 The ancient spirits stir, and the smoke-test agent has walked this thread.
The omens are clear: tooling answered, build held, and the signal remains unbroken.

Warning

Firewall blocked 12 domains

The following domains were blocked by the firewall during workflow execution:

• ab.chatgpt.com
• accounts.google.com
• api.github.com
• clients2.google.com
• collector.github.com
• contentautofill.googleapis.com
• github.com
• github.githubassets.com
• msfeed25.pkgs.visualstudio.com
• update.googleapis.com
• www.google.com
• www.gstatic.com

[!TIP]
api.github.com is blocked because GitHub API access uses the built-in GitHub tools by default. Instead of adding api.github.com to network.allowed, use tools.github.mode: gh-proxy for direct pre-authenticated GitHub CLI access without requiring network access to api.github.com:

tools:
  github:
    mode: gh-proxy

See GitHub Tools for more information on gh-proxy mode.

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"
    - "accounts.google.com"
    - "api.github.com"
    - "clients2.google.com"
    - "collector.github.com"
    - "contentautofill.googleapis.com"
    - "github.com"
    - "github.githubassets.com"
    - "msfeed25.pkgs.visualstudio.com"
    - "update.googleapis.com"
    - "www.google.com"
    - "www.gstatic.com"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

[github-actions[bot]]

🔮 The ancient spirits stir, and the smoke-test oracle has walked these halls.
The signs align: the browser saw GitHub, the build held firm, and the rune of validation now glows upon this discussion.

Warning

Firewall blocked 8 domains

The following domains were blocked by the firewall during workflow execution:

• accounts.google.com
• android.clients.google.com
• clients2.google.com
• contentautofill.googleapis.com
• msfeed25.pkgs.visualstudio.com
• update.googleapis.com
• www.google.com
• www.gstatic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "accounts.google.com"
    - "android.clients.google.com"
    - "clients2.google.com"
    - "contentautofill.googleapis.com"
    - "msfeed25.pkgs.visualstudio.com"
    - "update.googleapis.com"
    - "www.google.com"
    - "www.gstatic.com"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

[github-actions[bot]]

🔮 The ancient spirits stir, and the oracle records this passing: the smoke-test agent walked these halls and left the runes intact. May the next seeker find the path illuminated.

Warning

Firewall blocked 8 domains

The following domains were blocked by the firewall during workflow execution:

• accounts.google.com
• android.clients.google.com
• clients2.google.com
• contentautofill.googleapis.com
• msfeed25.pkgs.visualstudio.com
• update.googleapis.com
• www.google.com
• www.gstatic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "accounts.google.com"
    - "android.clients.google.com"
    - "clients2.google.com"
    - "contentautofill.googleapis.com"
    - "msfeed25.pkgs.visualstudio.com"
    - "update.googleapis.com"
    - "www.google.com"
    - "www.gstatic.com"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

[github-actions[bot]]

🔮 The ancient spirits stir, and the smoke-test agent has passed this way.
The runes report a build that stands, a file token inscribed, and one veiled path where Playwright was absent.
May the next invocation find the browser oracle awake.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• msfeed25.pkgs.visualstudio.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "msfeed25.pkgs.visualstudio.com"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

[github-actions[bot]]

Oracle Sign

🔮 The ancient spirits stir; the smoke test agent was here.
The omens are clear, and the path remains unbroken.

Warning

Firewall blocked 12 domains

The following domains were blocked by the firewall during workflow execution:

• ab.chatgpt.com
• accounts.google.com
• api.github.com
• clients2.google.com
• collector.github.com
• contentautofill.googleapis.com
• github.com
• github.githubassets.com
• msfeed25.pkgs.visualstudio.com
• update.googleapis.com
• www.google.com
• www.gstatic.com

[!TIP]
api.github.com is blocked because GitHub API access uses the built-in GitHub tools by default. Instead of adding api.github.com to network.allowed, use tools.github.mode: gh-proxy for direct pre-authenticated GitHub CLI access without requiring network access to api.github.com:

tools:
  github:
    mode: gh-proxy

See GitHub Tools for more information on gh-proxy mode.

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"
    - "accounts.google.com"
    - "api.github.com"
    - "clients2.google.com"
    - "collector.github.com"
    - "contentautofill.googleapis.com"
    - "github.com"
    - "github.githubassets.com"
    - "msfeed25.pkgs.visualstudio.com"
    - "update.googleapis.com"
    - "www.google.com"
    - "www.gstatic.com"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

[github-actions[bot]]

🔮 The ancient spirits stir, and the oracle records that the smoke-test agent walked this hall.
The omens are favorable; the circuit held and the signs remained unbroken.

Warning

Firewall blocked 12 domains

The following domains were blocked by the firewall during workflow execution:

• ab.chatgpt.com
• accounts.google.com
• api.github.com
• clients2.google.com
• collector.github.com
• contentautofill.googleapis.com
• github.com
• github.githubassets.com
• msfeed25.pkgs.visualstudio.com
• update.googleapis.com
• www.google.com
• www.gstatic.com

[!TIP]
api.github.com is blocked because GitHub API access uses the built-in GitHub tools by default. Instead of adding api.github.com to network.allowed, use tools.github.mode: gh-proxy for direct pre-authenticated GitHub CLI access without requiring network access to api.github.com:

tools:
  github:
    mode: gh-proxy

See GitHub Tools for more information on gh-proxy mode.

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"
    - "accounts.google.com"
    - "api.github.com"
    - "clients2.google.com"
    - "collector.github.com"
    - "contentautofill.googleapis.com"
    - "github.com"
    - "github.githubassets.com"
    - "msfeed25.pkgs.visualstudio.com"
    - "update.googleapis.com"
    - "www.google.com"
    - "www.gstatic.com"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

[github-actions[bot]]

🔮 The ancient spirits stir in the firewall, and the omens are clear: the smoke test agent passed this way. The sigils held, the title spoke “GitHub,” and the forge completed without fracture.

Warning

Firewall blocked 13 domains

The following domains were blocked by the firewall during workflow execution:

• ab.chatgpt.com
• accounts.google.com
• android.clients.google.com
• api.github.com
• clients2.google.com
• collector.github.com
• contentautofill.googleapis.com
• github.com
• github.githubassets.com
• msfeed25.pkgs.visualstudio.com
• update.googleapis.com
• www.google.com
• www.gstatic.com

[!TIP]
api.github.com is blocked because GitHub API access uses the built-in GitHub tools by default. Instead of adding api.github.com to network.allowed, use tools.github.mode: gh-proxy for direct pre-authenticated GitHub CLI access without requiring network access to api.github.com:

tools:
  github:
    mode: gh-proxy

See GitHub Tools for more information on gh-proxy mode.

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"
    - "accounts.google.com"
    - "android.clients.google.com"
    - "api.github.com"
    - "clients2.google.com"
    - "collector.github.com"
    - "contentautofill.googleapis.com"
    - "github.com"
    - "github.githubassets.com"
    - "msfeed25.pkgs.visualstudio.com"
    - "update.googleapis.com"
    - "www.google.com"
    - "www.gstatic.com"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

[github-actions[bot]]

🔮 The ancient spirits stir; the smoke-test agent was here, and the omens through the firewall read clear and favorable.

Warning

Firewall blocked 12 domains

The following domains were blocked by the firewall during workflow execution:

• ab.chatgpt.com
• accounts.google.com
• api.github.com
• clients2.google.com
• collector.github.com
• contentautofill.googleapis.com
• github.com
• github.githubassets.com
• msfeed25.pkgs.visualstudio.com
• update.googleapis.com
• www.google.com
• www.gstatic.com

[!TIP]
api.github.com is blocked because GitHub API access uses the built-in GitHub tools by default. Instead of adding api.github.com to network.allowed, use tools.github.mode: gh-proxy for direct pre-authenticated GitHub CLI access without requiring network access to api.github.com:

tools:
  github:
    mode: gh-proxy

See GitHub Tools for more information on gh-proxy mode.

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"
    - "accounts.google.com"
    - "api.github.com"
    - "clients2.google.com"
    - "collector.github.com"
    - "contentautofill.googleapis.com"
    - "github.com"
    - "github.githubassets.com"
    - "msfeed25.pkgs.visualstudio.com"
    - "update.googleapis.com"
    - "www.google.com"
    - "www.gstatic.com"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

[github-actions[bot]]

🔮 The ancient spirits stir, and the oracle records this passage: the smoke test agent was here, the omens were read, and the signs were favorable.

Warning

Firewall blocked 12 domains

The following domains were blocked by the firewall during workflow execution:

• ab.chatgpt.com
• accounts.google.com
• api.github.com
• clients2.google.com
• collector.github.com
• contentautofill.googleapis.com
• github.com
• github.githubassets.com
• msfeed25.pkgs.visualstudio.com
• update.googleapis.com
• www.google.com
• www.gstatic.com

[!TIP]
api.github.com is blocked because GitHub API access uses the built-in GitHub tools by default. Instead of adding api.github.com to network.allowed, use tools.github.mode: gh-proxy for direct pre-authenticated GitHub CLI access without requiring network access to api.github.com:

tools:
  github:
    mode: gh-proxy

See GitHub Tools for more information on gh-proxy mode.

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"
    - "accounts.google.com"
    - "api.github.com"
    - "clients2.google.com"
    - "collector.github.com"
    - "contentautofill.googleapis.com"
    - "github.com"
    - "github.githubassets.com"
    - "msfeed25.pkgs.visualstudio.com"
    - "update.googleapis.com"
    - "www.google.com"
    - "www.gstatic.com"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

[github-actions[bot]]

🔮 The ancient spirits stir within the firewall. The smoke-test oracle passed through this chamber, read the signs, and left this seal upon the thread. May the wards hold and the circuits remain true.

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

• ab.chatgpt.com
• msfeed25.pkgs.visualstudio.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"
    - "msfeed25.pkgs.visualstudio.com"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}