diff --git a/.github/aw/evals.md b/.github/aw/evals.md
index 59d1a06ae9e..3d1e0b63a93 100644
--- a/.github/aw/evals.md
+++ b/.github/aw/evals.md
@@ -126,6 +126,8 @@ Do not combine mutually exclusive scenarios into one question list. If a questio
### Good question checklist
+- ✅ Answerable from the agent output alone — no external calls needed.
+- ✅ Exactly one binary claim per question.
- ✅ Uses YES = success convention consistently.
- ✅ Avoids subjective terms ("good", "well-written") unless the question explicitly bounds them ("according to the coding style guide").
diff --git a/docs/src/assets/diagrams/architecture-2026-08-29.svg b/docs/src/assets/diagrams/architecture-2026-08-29.svg
index 420523a2380..2e36fc8141a 100644
--- a/docs/src/assets/diagrams/architecture-2026-08-29.svg
+++ b/docs/src/assets/diagrams/architecture-2026-08-29.svg
@@ -54,19 +54,18 @@
create_pull_request
-
-
-
-
-
+
+
+
+
GitHub
API
-
+
diff --git a/pkg/cli/add_package_manifest_includes.go b/pkg/cli/add_package_manifest_includes.go
index 79e11bc69fa..b44599ce962 100644
--- a/pkg/cli/add_package_manifest_includes.go
+++ b/pkg/cli/add_package_manifest_includes.go
@@ -143,7 +143,7 @@ func parseManifestIncludeMapping(mapping map[string]any, manifestPath string) (r
// paths that escape their root.
func cleanManifestRelativePath(p string) (string, error) {
slashed := filepath.ToSlash(p)
- if slashed != "" && (slashed[0] == '/' || slashed[0] == '\\') || filepath.IsAbs(p) || isWindowsDriveRelativePath(slashed) {
+ if slashed != "" && ((slashed[0] == '/' || slashed[0] == '\\') || filepath.IsAbs(p) || isWindowsDriveRelativePath(slashed)) {
return "", errors.New("absolute paths are not allowed")
}
cleaned := path.Clean(slashed)
diff --git a/pkg/workflow/allowed_domains_sanitization_test.go b/pkg/workflow/allowed_domains_sanitization_test.go
index 63272ff3ee3..dd260c3770c 100644
--- a/pkg/workflow/allowed_domains_sanitization_test.go
+++ b/pkg/workflow/allowed_domains_sanitization_test.go
@@ -64,10 +64,6 @@ Test workflow with network permissions.
expectedDomains: []string{
"example.com",
"test.org",
- // Copilot defaults should also be included
- "api.github.com",
- "github.com",
- "raw.githubusercontent.com",
},
unexpectedDomain: "registry.npmjs.org",
},
@@ -96,12 +92,7 @@ Test workflow with network permissions.
expectedDomains: []string{
"example.com",
"test.org",
- // Claude now has its own default domains with AWF support
- "api.github.com",
- "anthropic.com",
- "api.anthropic.com",
},
- // No unexpected domains - Claude has its own defaults
unexpectedDomain: "",
},
{
@@ -122,15 +113,8 @@ safe-outputs:
Test workflow with defaults network.
`,
- expectedDomains: []string{
- // Should have Copilot defaults
- "api.github.com",
- "github.com",
- "raw.githubusercontent.com",
- // Note: network: defaults for Copilot doesn't expand ecosystem domains
- // in GetCopilotAllowedDomains - it only merges when network.allowed has values
- },
- unexpectedDomain: "",
+ expectedDomains: []string{"json-schema.org", "archive.ubuntu.com"},
+ unexpectedDomain: "api.githubcopilot.com",
},
{
name: "Copilot without network config",
@@ -149,14 +133,8 @@ safe-outputs:
Test workflow without network config.
`,
- expectedDomains: []string{
- // Should have Copilot defaults
- "api.github.com",
- "github.com",
- "raw.githubusercontent.com",
- // Note: nil network for Copilot only returns Copilot defaults
- },
- unexpectedDomain: "",
+ expectedDomains: []string{},
+ unexpectedDomain: "api.githubcopilot.com",
},
{
name: "Claude with ecosystem identifier",
@@ -319,7 +297,6 @@ Test that empty allowed-domains falls back to network config.
`,
expectedDomains: []string{
"example.com",
- "api.github.com", // Copilot default
},
unexpectedDomain: "",
},
@@ -406,8 +383,6 @@ func TestComputeAllowedDomainsForSanitization(t *testing.T) {
expectedDomains: []string{
"example.com",
"test.org",
- "api.github.com", // Copilot default
- "github.com", // Copilot default
},
},
{
@@ -422,25 +397,16 @@ func TestComputeAllowedDomainsForSanitization(t *testing.T) {
},
},
{
- name: "Copilot with nil network",
- engineID: "copilot",
- networkPerms: nil,
- expectedDomains: []string{
- "api.github.com", // Copilot default
- "github.com", // Copilot default
- "raw.githubusercontent.com", // Copilot default
- // Note: When network is nil, GetCopilotAllowedDomains only returns Copilot defaults
- // It does NOT include ecosystem defaults
- },
+ name: "Copilot with nil network",
+ engineID: "copilot",
+ networkPerms: nil,
+ expectedDomains: []string{},
},
{
- name: "Claude with nil network",
- engineID: "claude",
- networkPerms: nil,
- expectedDomains: []string{
- "json-schema.org", // ecosystem default
- "archive.ubuntu.com", // ecosystem default
- },
+ name: "Claude with nil network",
+ engineID: "claude",
+ networkPerms: nil,
+ expectedDomains: []string{},
},
{
name: "Codex with custom domains",
@@ -460,8 +426,6 @@ func TestComputeAllowedDomainsForSanitization(t *testing.T) {
expectedDomains: []string{
"api.acme.ghe.com", // GHES API domain
"acme.ghe.com", // GHES base domain (derived from api-target)
- "api.github.com", // Copilot default
- "github.com", // Copilot default
},
},
{
@@ -493,6 +457,9 @@ func TestComputeAllowedDomainsForSanitization(t *testing.T) {
// Call the function
domainsStr, err := compiler.computeAllowedDomainsForSanitization(data)
require.NoError(t, err, "computeAllowedDomainsForSanitization should not return an error for valid test data")
+ if len(tt.expectedDomains) == 0 {
+ require.Empty(t, domainsStr, "expected no domains without network configuration")
+ }
// Verify expected domains are present (substring match is fine here since domain names
// in a CSV string that are exact entries won't appear as substrings of other entries
@@ -548,8 +515,6 @@ Test workflow with GHES api-target.
expectedDomains: []string{
"api.acme.ghe.com", // GHES API domain
"acme.ghe.com", // GHES base domain derived from api-target
- "api.github.com", // Copilot default
- "github.com", // Copilot default
},
},
{
@@ -963,7 +928,7 @@ func TestAllowedDomainsUnionWithNetworkConfig(t *testing.T) {
expectedDomains []string
}{
{
- name: "allowed-domains unioned with Copilot defaults and network config",
+ name: "allowed-domains unioned with network config",
workflow: `---
on: push
permissions:
@@ -987,7 +952,6 @@ Test allowed-domains union with network config.
expectedDomains: []string{
"extra-domain.com", // from allowed-domains
"example.com", // from network.allowed
- "api.github.com", // Copilot default
"localhost", // always included
"github.com", // always included
},
@@ -1045,7 +1009,6 @@ Test that allowed-domains does not override network config.
expectedDomains: []string{
"url-domain.com", // from allowed-domains
"network-domain.com", // from network.allowed - still present (union)
- "api.github.com", // Copilot default
"localhost", // always included
},
},
diff --git a/pkg/workflow/domains_protocol_integration_test.go b/pkg/workflow/domains_protocol_integration_test.go
index 178854d9ce0..15a9d16162b 100644
--- a/pkg/workflow/domains_protocol_integration_test.go
+++ b/pkg/workflow/domains_protocol_integration_test.go
@@ -42,7 +42,6 @@ Test protocol-specific domain filtering.
"https://secure.example.com",
"http://legacy.example.com",
"example.org",
- "api.github.com", // Copilot default
},
checkAWFArgs: true,
},