Skip to content

Centralize engine default domain sets #55461

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
pelikhan merged 7 commits into from
Aug 24, 2026
Merged

Centralize engine default domain sets #55461

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
03724be
Centralize engine default domain sets
Copilot Aug 24, 2026
7dc9cba
Protect registered engine domain sets
Copilot Aug 24, 2026
3cd8e22
docs(adr): add draft ADR-55461 for centralizing engine default domain…
github-actions[bot] Aug 24, 2026
a099902
Centralize workflow domain data in JSON
Copilot Aug 24, 2026
03a3bcb
Preserve threat detection network alias
Copilot Aug 24, 2026
d671c0c
Merge branch 'main' into copilot/refactor-default-domain-sets
github-actions[bot] Aug 24, 2026
5e44cf7
Finalize domain registry ADR
Copilot Aug 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Protect registered engine domain sets 
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
  • Loading branch information
@pelikhan
Copilot and pelikhan authored Aug 24, 2026
commit 7dc9cba8329d3749b2771b8d9691f4e7c0bc5e0b
18 changes: 11 additions & 7 deletions pkg/workflow/domains.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -178,33 +178,37 @@ var engineDefaultDomainSets = map[string][]string{
func GetEngineDefaultDomainSets() map[string][]string {
sets := make(map[string][]string, len(engineDefaultDomainSets))
for name, domains := range engineDefaultDomainSets {
sets[name] = append([]string(nil), domains...)
sets[name] = copyEngineDefaultDomainSet(domains)
}
return sets
}

func copyEngineDefaultDomainSet(domains []string) []string {
return append([]string(nil), domains...)
}

// CopilotDefaultDomains are the default domains required for GitHub Copilot CLI authentication and operation.
//
// This list is limited to the shared gateway/GitHub transport baseline: the MCP/API gateway
// (host.docker.internal), the GitHub API and web hosts, and the Copilot routing hub used for
// inference. Plan-specific Copilot API hosts (business/enterprise/individual) and Copilot
// telemetry are *not* part of the default set: agents route inference through the AWF api-proxy,
// so those vendor hosts require an explicit `network: { allowed: [copilot-vendor] }` opt-in.
var CopilotDefaultDomains = engineDefaultDomainSets["copilot"]
var CopilotDefaultDomains = copyEngineDefaultDomainSet(engineDefaultDomainSets["copilot"])

// CodexDefaultDomains are the minimal default domains required for Codex CLI operation.
var CodexDefaultDomains = engineDefaultDomainSets["codex"]
var CodexDefaultDomains = copyEngineDefaultDomainSet(engineDefaultDomainSets["codex"])

// ClaudeDefaultDomains are the default domains required for Claude Code CLI authentication and operation.
var ClaudeDefaultDomains = engineDefaultDomainSets["claude"]
var ClaudeDefaultDomains = copyEngineDefaultDomainSet(engineDefaultDomainSets["claude"])

// GeminiDefaultDomains are the default domains required for Google Gemini CLI authentication and operation.
var GeminiDefaultDomains = engineDefaultDomainSets["gemini"]
var GeminiDefaultDomains = copyEngineDefaultDomainSet(engineDefaultDomainSets["gemini"])

// PiBaseDefaultDomains are the base domains required for the Pi CLI to operate,
// independent of the chosen LLM provider. When a model uses provider/model format,
// provider-specific API domains are added on top via GetDefaultDomainsForEngine.
var PiBaseDefaultDomains = engineDefaultDomainSets["pi-base"]
var PiBaseDefaultDomains = copyEngineDefaultDomainSet(engineDefaultDomainSets["pi-base"])

// piProviderDomains maps provider prefixes to their API domains.
// Covers the same set of providers that Pi can route through via the AWF LLM gateway.
Expand All @@ -222,7 +226,7 @@ var piProviderDomains = map[string]string{
// PiDefaultDomains are the static default domains for backward compatibility when
// no model provider prefix is given. When a provider/model format is used, the
// dynamic path (GetDefaultDomainsForEngine) resolves provider-specific domains instead.
var PiDefaultDomains = engineDefaultDomainSets["pi"]
var PiDefaultDomains = copyEngineDefaultDomainSet(engineDefaultDomainSets["pi"])

// extractProviderFromModel parses "provider/model" format and returns the
// lowercase provider prefix. Returns ("", nil) when no model is given or the
Expand Down
8 changes: 8 additions & 0 deletions pkg/workflow/domains_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -459,6 +459,14 @@ func TestGetEngineDefaultDomainSets(t *testing.T) {
sets["copilot"][0] = "modified.example.com"
assert.NotEqual(t, "modified.example.com", CopilotDefaultDomains[0],
"callers must not be able to modify registered domain sets")

original := CopilotDefaultDomains[0]
t.Cleanup(func() {
CopilotDefaultDomains[0] = original
})
CopilotDefaultDomains[0] = "modified.example.com"
assert.Equal(t, original, GetEngineDefaultDomainSets()["copilot"][0],
"exported compatibility variables must not modify registered domain sets")
}

func TestGetThreatDetectionAllowedDomains(t *testing.T) {
Expand Down
Loading