docs: document implicit CLI behaviors (localhost keyword, enterprise auto-detection)

[Copilot]

The CLI reference didn't document several implicit behaviors: the localhost keyword shortcut, enterprise domain auto-detection (GHEC/GHES), and had minimal coverage of protocol-specific filtering and wildcard patterns.

CLI reference (reference/cli-reference.md)

• localhost keyword: Documents that --allow-domains localhost replaces with host.docker.internal, auto-enables --enable-host-access, and opens common dev ports (3000, 3001, 4000, 4200, 5000, 5173, 8000, 8080, 8081, 8888, 9000, 9090)
• Enterprise auto-detection: New "Implicit Behaviors" section documenting:
  • GHEC: GITHUB_SERVER_URL with *.ghe.com auto-adds tenant, api.*, copilot-api.*, copilot-telemetry-service.*
  • GHES: ENGINE_API_TARGET auto-adds base domain, API subdomain, and Copilot cloud domains
• Protocol-specific filtering: Added summary table showing domain.com (both), https://domain.com (HTTPS only), http://domain.com (HTTP only)
• Wildcard patterns: Added pattern matching rules table with match/no-match examples

Domain filtering guide (guides/domain-filtering.md)

• Added protocol-specific filtering section with examples and table
• Fixed incorrect normalization docs — previously stated "Protocols stripped: https://github.com = github.com" which is wrong; protocol prefixes are meaningful for protocol-specific filtering

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• telemetry.astro.build
  • Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node node /home/REDACTED/work/gh-aw-firewall/gh-aw-firewall/docs-site/node_modules/.bin/astro build (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[Copilot]

Pull request overview

Updates the AWF documentation to explicitly describe previously implicit CLI behaviors around domain allowlisting and filtering, helping users predict how awf expands and interprets domain inputs.

Changes:

• Expanded --allow-domains documentation with protocol-specific filtering, wildcard matching rules, and the localhost keyword behavior.
• Added an “Implicit Behaviors” section describing enterprise (GHEC/GHES) domain auto-detection and auto-allowlisting.
• Corrected domain normalization docs to reflect that protocol prefixes are meaningful (not stripped).

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
docs-site/src/content/docs/reference/cli-reference.md	Documents --allow-domains keywords/patterns and adds enterprise auto-detection (“Implicit Behaviors”).
docs-site/src/content/docs/guides/domain-filtering.md	Adds protocol-specific filtering guidance and fixes normalization docs regarding protocol prefixes.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The statement that “If no domains are specified, all network access is blocked” is not always true once implicit allowlist expansion runs. In enterprise environments, domains may be auto-added from GITHUB_SERVER_URL/GITHUB_API_URL (GHEC) or ENGINE_API_TARGET (GHES) even when the user doesn’t pass --allow-domains. Consider clarifying this sentence (or adding a note) to describe that implicit behaviors can add domains to an otherwise empty allowlist.

See below for a potential fix:

**If no domains are specified, network access is blocked by default.** This is useful for running commands that should have no network access.

**Note:** In some enterprise environments, domains may still be added implicitly to the allowlist from configuration such as `GITHUB_SERVER_URL`, `GITHUB_API_URL`, or `ENGINE_API_TARGET`, even when `--allow-domains` is not provided.

```bash
# Allow specific domains
--allow-domains github.com,npmjs.org
--allow-domains '*.github.com,api-*.example.com'

# No network access by default when omitted

[Copilot]

The CLI only replaces the first occurrence of localhost/http://localhost/https://localhost in the allowlist (additional occurrences are left unchanged). Consider documenting this so users don’t expect multiple localhost entries (e.g., mixed protocol) to all be rewritten automatically.

[github-actions]

Documentation Preview

Documentation build failed for this PR. View logs.

Built from commit 43532ac