feat: enable firewall on claude and remove hooks" #4792

Mossaka · 2025-11-26T00:28:47Z

feat: enable firewall on claude engine ana remove hooks
update the awf to v0.4.0

Smoke Test: Copilot Engine (No Firewall)

Timestamp: 2025-11-28 00:31 UTC
Status: PASS ✅
All core functionalities validated: GitHub MCP, file writing, bash tools, and Playwright MCP.

AI generated by Smoke Copilot No Firewall

Changeset

Type: patch
Description: Enable firewall on the Claude engine, remove obsolete hooks, and update AWF to v0.4.0.

AI generated by Changeset Generator

Smoke Test Summary (Run 19878489061)

Timestamp: 2025-12-03T00:51:48Z
Status: PASS
All core functionality validated: GitHub MCP, file operations, bash execution, and Playwright browser automation.

AI generated by Smoke Copilot No Firewall

Changeset

Type: patch
Description: Enable firewall on the Claude engine, remove obsolete hooks, and update AWF to v0.4.0.

AI generated by Changeset Generator

Smoke Test Summary

Test Run: 2025-12-03T01:12:23Z
Status: PASS
Summary: All tools validated - GitHub MCP, file operations, bash execution, and Playwright browser automation working correctly.

AI generated by Smoke Copilot No Firewall

github-actions · 2025-11-26T00:29:44Z

✅ Agentic Changeset Generator completed successfully.

Copilot

Pull request overview

This pull request enables firewall support for the Claude engine and removes the legacy network permissions hooks system. The changes replace the hook-based approach (which used Python scripts and Claude settings.json) with the AWF (Agentic Workflows Firewall) binary approach that was previously only available for the Copilot engine. Additionally, the AWF version is updated from v0.3.0 to v0.4.0.

Key changes:

Claude engine now supports AWF firewall (matching Copilot's capabilities)
Removed deprecated hooks-based network permissions system
Updated enableFirewallByDefault to use engine interface instead of string-based engine ID
Added GetClaudeAllowedDomains helper function for Claude-specific domain handling
Updated all tests to reflect Claude's new firewall support

Reviewed changes

Copilot reviewed 66 out of 66 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
`pkg/workflow/claude_engine.go`	Enabled firewall support flag; removed hooks/settings generation; added AWF wrapper logic in GetExecutionSteps; implemented GetSquidLogsSteps
`pkg/workflow/firewall.go`	Refactored `enableFirewallByDefault` to accept engine interface and check `SupportsFirewall()` method
`pkg/workflow/domains.go`	Added `GetClaudeAllowedDomains` function for Claude-specific domain handling (similar to Copilot's)
`pkg/workflow/compiler.go`	Updated call to `enableFirewallByDefault` to pass engine instead of engine ID string
`pkg/constants/constants.go`	Updated DefaultFirewallVersion from v0.3.0 to v0.4.0
`pkg/workflow/engine_firewall_support_test.go`	Updated tests to verify Claude now supports firewall
`pkg/workflow/firewall_default_enablement_test.go`	Updated tests to use engine instances; added Claude firewall tests
`pkg/workflow/firewall_workflow_test.go`	Updated tests to expect AWF installation instead of hooks for Claude
`pkg/workflow/claude_engine_network_test.go`	Updated all tests to expect AWF wrapper instead of settings/hooks
`pkg/workflow/network_test.go`	Removed deprecated test for `HasNetworkPermissions`
`pkg/workflow/agentic_output_test.go`	Removed tests for Claude hooks cleanup (no longer needed)
`pkg/workflow/claude_settings.go`	Deleted (hooks-based settings no longer used)
`pkg/workflow/claude_settings_test.go`	Deleted (tests for deleted functionality)
`pkg/workflow/claude_settings_tmp_test.go`	Deleted (tests for deleted functionality)
`pkg/workflow/engine_network_hooks.go`	Deleted (hooks system no longer used)
`pkg/workflow/engine_network_test.go`	Deleted (tests for deleted functionality)
`.github/workflows/*.lock.yml`	All compiled workflows updated to use AWF v0.4.0 and remove hooks generation steps

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

pelikhan · 2025-11-26T00:31:27Z

@copilot Claude agentic engine should be updated to reflect that it supports network firewall.

Copilot · 2025-11-26T00:31:41Z

@pelikhan I've opened a new pull request, #4794, to work on those changes. Once the pull request is ready, I'll request review from you.

Mossaka · 2025-11-26T00:31:17Z

.github/aw/actions-lock.json

+    "actions/github-script@v7": {
+      "repo": "actions/github-script",
+      "version": "v7",
+      "sha": "f28e40c7f34bde8b3046d885e986cb6290c5673b"
+    },


@copilot remove github-script@v7 from this branch

Mossaka · 2025-11-26T00:31:37Z

.github/aw/actions-lock.json

+    "actions/github-script@v7": {
+      "repo": "actions/github-script",
+      "version": "v7",
+      "sha": "f28e40c7f34bde8b3046d885e986cb6290c5673b"
+    },


@copilot remove github-script@v7 from this pr

Copilot · 2025-11-26T00:31:53Z

@Mossaka I've opened a new pull request, #4795, to work on those changes. Once the pull request is ready, I'll request review from you.

github-actions · 2025-11-26T20:47:05Z

✅ Agentic Changeset Generator completed successfully.

Mossaka · 2025-11-26T21:09:00Z

@copilot can you figure out why the integration test is failing and can you fix it? https://github.com/githubnext/gh-aw/actions/runs/19717073693/job/56491771896?pr=4792

github-actions · 2025-11-26T21:09:00Z

✅ Agentic Changeset Generator completed successfully.

Copilot · 2025-11-26T21:09:10Z

@Mossaka I've opened a new pull request, #4884, to work on those changes. Once the pull request is ready, I'll request review from you.

github-actions · 2025-11-27T00:30:19Z

❌ Agentic Smoke Copilot failed and wasn't able to produce a result.

github-actions · 2025-11-27T00:30:19Z

Agentic Smoke Codex triggered by this pull request.

github-actions · 2025-11-27T00:30:20Z

Agentic Smoke Copilot No Firewall triggered by this pull request.

github-actions · 2025-12-03T00:50:12Z

🎉 Yo ho ho! Changeset Generator found the treasure and completed successfully! ⚓💰

github-actions · 2025-12-03T00:50:13Z

🔮 The ancient spirits stir... Smoke Codex awakens to divine this pull request...

github-actions · 2025-12-03T00:50:13Z

🤖 SYSTEM_INIT: Smoke Copilot No Firewall ACTIVATED. PROCESSING pull request. ALL SUBSYSTEMS ONLINE.

github-actions · 2025-12-03T00:52:26Z

Smoke Test Results

Last 2 Merged PRs:

Convert embedded custom agents to prompt file format #5337: Convert embedded custom agents to prompt file format
refactor: rename to firewall-escape.md, add 80% novelty requirement, and increase timeout #4789: refactor: rename to firewall-escape.md, add 80% novelty requirement, and increase timeout

Test Results:

✅ GitHub MCP: Retrieved recent PRs
✅ File Writing: Created test file successfully
✅ Bash Tool: Verified file content

Status: PASS

📰 BREAKING: Report filed by Smoke Copilot fer issue #4792 🗺️

github-actions · 2025-12-03T00:53:05Z

Smoke Test Results

Timestamp: 2025-12-03T00:51:48Z

✅ GitHub MCP: Last 2 PRs retrieved (Convert embedded custom agents to prompt file format #5337, refactor: rename to firewall-escape.md, add 80% novelty requirement, and increase timeout #4789)
✅ File Writing: Created /tmp/gh-aw/agent/smoke-test-copilot-19878489061.txt
✅ Bash Tool: Verified file creation
✅ Playwright MCP: Navigated to github.com, title contains "GitHub"

Overall Status: PASS

🤖 DIAGNOSTIC REPORT GENERATED BY Smoke Copilot No Firewall fer issue #4792 🗺️

github-actions · 2025-12-03T00:53:34Z

Convert embedded custom agents to prompt file format
refactor: rename to firewall-escape.md, add 80% novelty requirement, and increase timeout
GitHub MCP test ✅
File write test ✅ (/tmp/gh-aw/agent/smoke-test-codex-19878489043.txt)
Bash cat test ✅
Playwright title test ✅
Overall: PASS

🔮 The oracle has spoken through Smoke Codex fer issue #4792 🗺️

github-actions · 2025-12-03T00:53:35Z

Smoke Test Results: Copilot Engine + Playwright

✅ Playwright Navigation: Successfully navigated to https://github.com
✅ Page Title Verification: Confirmed title contains "GitHub"

Overall Status: ✅ PASS

📰 BREAKING: Report filed by Smoke Copilot Playwright fer issue #4792 🗺️

pelikhan · 2025-12-03T00:56:17Z

Too old.

Signed-off-by: Jiaxiao (mossaka) Zhou <duibao55328@gmail.com>

Mossaka · 2025-12-03T01:02:37Z

Oh wait, I am working on this one!

github-actions · 2025-12-03T01:10:45Z

🔮 The ancient spirits stir... Smoke Codex awakens to divine this pull request...

github-actions · 2025-12-03T01:10:46Z

💫 TO BE CONTINUED... Smoke Claude failed! Our hero faces unexpected challenges...

github-actions · 2025-12-03T01:10:47Z

🤖 SYSTEM_INIT: Smoke Copilot No Firewall ACTIVATED. PROCESSING pull request. ALL SUBSYSTEMS ONLINE.

github-actions · 2025-12-03T01:10:49Z

📰 BREAKING: Smoke Copilot Playwright is now investigating this pull request. Sources say the story is developing...

github-actions · 2025-12-03T01:10:49Z

🎉 Yo ho ho! Changeset Generator found the treasure and completed successfully! ⚓💰

github-actions · 2025-12-03T01:10:50Z

📰 DEVELOPING STORY: Smoke Copilot reports failed. Our correspondents are investigating the incident...

github-actions · 2025-12-03T01:13:45Z

Smoke Test Results (Copilot - No Firewall)

Last 2 Merged PRs:

Migrate workflow commands (run, status, logs, audit) to RunE #5329: Migrate workflow commands (run, status, logs, audit) to RunE
Add safe output for assigning users to issues #5333: Add safe output for assigning users to issues

Test Results:

✅ GitHub MCP: Retrieved recent merged PRs
✅ File Writing: Created test file successfully
✅ Bash Tool: Verified file content
✅ Playwright: Navigated to GitHub, title verified

Overall: PASS

🤖 DIAGNOSTIC REPORT GENERATED BY Smoke Copilot No Firewall fer issue #4792 🗺️

github-actions · 2025-12-03T01:14:00Z

Migrate workflow commands (run, status, logs, audit) to RunE
Convert embedded custom agents to prompt file format
✅ GitHub MCP review
✅ File write + cat
✅ Playwright title check
Overall: PASS

🔮 The oracle has spoken through Smoke Codex fer issue #4792 🗺️

github-actions · 2025-12-03T01:14:07Z

Smoke Test Results

✅ Playwright Navigation: Successfully navigated to https://github.com
✅ Page Title Validation: Title contains "GitHub" ✓

Overall Status: PASS

📰 BREAKING: Report filed by Smoke Copilot Playwright fer issue #4792 🗺️

Mossaka · 2025-12-03T23:45:01Z

This PR will be blocked by a new release of awf that supports user mode

Copilot AI review requested due to automatic review settings November 26, 2025 00:28

Mossaka added smoke changeset labels Nov 26, 2025

Copilot started reviewing on behalf of Mossaka November 26, 2025 00:29 View session

Copilot finished reviewing on behalf of Mossaka November 26, 2025 00:30

Copilot AI reviewed Nov 26, 2025

View reviewed changes

Copilot AI mentioned this pull request Nov 26, 2025

feat: enable firewall on claude and remove hooks #4794

Closed

Mossaka commented Nov 26, 2025

View reviewed changes

Copilot AI mentioned this pull request Nov 26, 2025

Remove github-script@v7 from actions-lock.json #4795

Merged

Mossaka force-pushed the firewall-claude branch from 5be6c9a to de259ed Compare November 26, 2025 20:38

Mossaka added smoke and removed smoke labels Nov 26, 2025

Mossaka added smoke and removed smoke changeset labels Nov 26, 2025

Copilot AI mentioned this pull request Nov 26, 2025

[WIP] Fix firewall implementation on claude and update dependencies #4884

Merged

4 tasks

Mossaka force-pushed the firewall-claude branch from 2f2b0f6 to e7289bf Compare November 27, 2025 00:13

Mossaka added smoke and removed smoke labels Nov 27, 2025

Add changeset [skip-ci]

78eb6b8

pelikhan closed this Dec 3, 2025

github-actions bot mentioned this pull request Dec 3, 2025

Add assign-to-user safe output type #5340

Merged

24 tasks

add tty and define default domains for operation

2e24818

Signed-off-by: Jiaxiao (mossaka) Zhou <duibao55328@gmail.com>

Mossaka added smoke and removed smoke labels Dec 3, 2025

Mossaka reopened this Dec 3, 2025

Merge branch 'main' into firewall-claude

63bcd2a

Mossaka added smoke and removed smoke labels Dec 3, 2025

Add changeset for PR #4792: enable firewall on Claude [skip-ci]

4189b20

feat: enable firewall on claude and remove hooks" #4792

Are you sure you want to change the base?

feat: enable firewall on claude and remove hooks" #4792

Uh oh!

Conversation

Mossaka commented Nov 26, 2025 • edited by github-actions bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Smoke Test: Copilot Engine (No Firewall)

Changeset

Smoke Test Summary (Run 19878489061)

Changeset

Smoke Test Summary

Uh oh!

github-actions bot commented Nov 26, 2025 • edited by agentic-workflows-dev bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

pelikhan commented Nov 26, 2025

Uh oh!

Copilot AI commented Nov 26, 2025

Uh oh!

Mossaka Nov 26, 2025

Choose a reason for hiding this comment

Uh oh!

Mossaka Nov 26, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI commented Nov 26, 2025

Uh oh!

github-actions bot commented Nov 26, 2025 • edited by agentic-workflows-dev bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Mossaka commented Nov 26, 2025

Uh oh!

github-actions bot commented Nov 26, 2025 • edited by agentic-workflows-dev bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI commented Nov 26, 2025

Uh oh!

github-actions bot commented Nov 27, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Nov 27, 2025

Uh oh!

github-actions bot commented Nov 27, 2025

Uh oh!

github-actions bot commented Dec 3, 2025 • edited by agentic-workflows-dev bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Dec 3, 2025

Uh oh!

github-actions bot commented Dec 3, 2025

Uh oh!

github-actions bot commented Dec 3, 2025

Smoke Test Results

Uh oh!

github-actions bot commented Dec 3, 2025

Smoke Test Results

Uh oh!

github-actions bot commented Dec 3, 2025

Uh oh!

github-actions bot commented Dec 3, 2025

Smoke Test Results: Copilot Engine + Playwright

Uh oh!

pelikhan commented Dec 3, 2025

Uh oh!

Mossaka commented Dec 3, 2025

Uh oh!

github-actions bot commented Dec 3, 2025

Uh oh!

github-actions bot commented Dec 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Dec 3, 2025

Uh oh!

github-actions bot commented Dec 3, 2025

Mossaka commented Nov 26, 2025 •

edited by github-actions bot

Loading

github-actions bot commented Nov 26, 2025 •

edited by agentic-workflows-dev bot

Loading

github-actions bot commented Nov 26, 2025 •

edited by agentic-workflows-dev bot

Loading

github-actions bot commented Nov 26, 2025 •

edited by agentic-workflows-dev bot

Loading

github-actions bot commented Nov 27, 2025 •

edited

Loading

github-actions bot commented Dec 3, 2025 •

edited by agentic-workflows-dev bot

Loading

github-actions bot commented Dec 3, 2025 •

edited

Loading

github-actions bot commented Dec 3, 2025 •

edited by agentic-workflows-dev bot

Loading

github-actions bot commented Dec 3, 2025 •

edited

Loading