From 5fd1cb4e2e1eae70740bc5331c874fefcd24b74d Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Sun, 26 Jul 2026 16:57:10 +0000 Subject: [PATCH] =?UTF-8?q?docs(network):=20fix=20CORE=5FALLOWED=5FHOSTS?= =?UTF-8?q?=20table=20=E2=80=94=20aka.ms=20is=20from=20Azure=20CLI=20exten?= =?UTF-8?q?sion,=20not=20core?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The default allowed domains table incorrectly claimed all entries were defined in CORE_ALLOWED_HOSTS. aka.ms is contributed at compile time by the always-on Azure CLI extension (src/compile/extensions/azure_cli.rs) and is not present in the CORE_ALLOWED_HOSTS static slice. - Remove aka.ms from the CORE_ALLOWED_HOSTS table - Add a callout below the table noting that the Azure CLI extension contributes aka.ms to the AWF allowlist - Update the Always-on Azure CLI section intro to accurately describe what the extension adds (only aka.ms is a net-new allowlist entry; the auth/management hosts it also declares are already in CORE_ALLOWED_HOSTS) Verified against src/allowed_hosts.rs (CORE_ALLOWED_HOSTS slice) and src/compile/extensions/azure_cli.rs (Declarations::network_hosts). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- docs/network.md | 13 ++++--------- 1 file changed, 4 insertions(+), 9 deletions(-) diff --git a/docs/network.md b/docs/network.md index 05af2261..c881c0a4 100644 --- a/docs/network.md +++ b/docs/network.md @@ -12,7 +12,7 @@ The `ado-aw` compiler binary is distributed via [GitHub Releases](https://github ## Default Allowed Domains -The following domains are always allowed. They are defined in `CORE_ALLOWED_HOSTS` in `allowed_hosts.rs`. `host.docker.internal` is deliberately **not** on this list — the agent has no route to the host under AWF's strict network topology, and SafeOutputs no longer runs as a host-side process at all: MCPG spawns it as a hardened, network-isolated (`--network none`) sibling stdio container; see [`docs/mcpg.md`](mcpg.md): +The following domains are always allowed via `CORE_ALLOWED_HOSTS` in `allowed_hosts.rs`. `host.docker.internal` is deliberately **not** on this list — the agent has no route to the host under AWF's strict network topology, and SafeOutputs no longer runs as a host-side process at all: MCPG spawns it as a hardened, network-isolated (`--network none`) sibling stdio container; see [`docs/mcpg.md`](mcpg.md): | Host Pattern | Purpose | |-------------|---------| @@ -48,17 +48,12 @@ The following domains are always allowed. They are defined in `CORE_ALLOWED_HOST | `dc.services.visualstudio.com` | Visual Studio telemetry | | `rt.services.visualstudio.com` | Visual Studio runtime telemetry | | `config.edge.skype.com` | Configuration | -| `aka.ms` | Microsoft link shortener (used by `az` subcommand metadata) — contributed by the always-on Azure CLI extension | + +The always-on Azure CLI extension additionally contributes `aka.ms` (Microsoft's link shortener, used by `az` subcommand metadata) to the AWF allowlist. See [Always-on Azure CLI (`az`)](#always-on-azure-cli-az) below. ## Always-on Azure CLI (`az`) -Every compiled pipeline adds the Azure auth and management hosts listed -above (`login.microsoftonline.com`, `login.windows.net`, -`management.azure.com`, `graph.microsoft.com`, `aka.ms`) to the AWF -allowlist and emits a small *Detect Azure CLI on host* prepare step -that runs early in the Agent job. This mirrors gh-aw's "assume `gh` is -on the runner" model: agents can call `az` from their bash tool -without opting in — *when the runner has it*. +Every compiled pipeline emits a small *Detect Azure CLI on host* prepare step that runs early in the Agent job. The always-on Azure CLI extension also adds `aka.ms` to the AWF allowlist (the auth and management hosts it declares are already present in `CORE_ALLOWED_HOSTS` above). This mirrors gh-aw's "assume `gh` is on the runner" model: agents can call `az` from their bash tool without opting in — *when the runner has it*. ### Runtime detection and graceful degradation