From a5e87878f5e277be1a0525de93e596632c6f5002 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Fri, 25 Sep 2026 08:47:52 +0000
Subject: [PATCH 1/2] [instructions] Document network.hosted-web policy in
 network.md
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The Sep-24 sync (#63142) covered release v0.89.21, but PR #63212
(merged after that sync) added the network.hosted-web frontmatter
field for Claude/Codex provider-hosted web tools without documenting
it in .github/aw/network.md — only a one-line import-merge note was
added to syntax-tools-imports.md.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 .github/aw/network.md | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/.github/aw/network.md b/.github/aw/network.md
index 3c94dae5e15..cd0c51f3cdd 100644
--- a/.github/aw/network.md
+++ b/.github/aw/network.md
@@ -141,6 +141,27 @@ These look like ecosystem identifiers but are **not recognised** — using them
 - **No protocol prefix**: `https://api.example.com` is invalid — write `api.example.com`.
 - **Subdomains must be explicit**: `github.com` does not cover `api.github.com`; use `*.github.com` or both.
 
+## Hosted Web Policy (`network.hosted-web`)
+
+Claude and Codex expose provider-hosted web search/fetch tools that run on provider infrastructure, outside the AWF sandbox — `network.allowed` does not constrain their destinations. Configure a separate policy to control them:
+
+```yaml
+network:
+  allowed:
+    - defaults
+  hosted-web:
+    allowed:
+      - docs.github.com
+    max-uses: 5
+```
+
+- `allowed` and `blocked` are mutually exclusive; each is a non-empty list of lowercase DNS hostnames (no wildcards).
+- `max-uses` optionally caps the number of hosted web tool invocations.
+- `hosted-web: false` rejects all hosted web tool calls for that workflow.
+- **Deny-by-default**: if `network` restricts domains for Claude or Codex without an explicit `hosted-web` policy, hosted web tools compile to disabled for that engine.
+- Ignored for engines other than Claude and Codex.
+- On import merge, allow/blocked lists from imported files combine with the main workflow's; a top-level scalar (`max-uses` or `hosted-web: false`) in either file takes precedence — see [syntax-tools-imports.md](syntax-tools-imports.md).
+
 ## Inferring Ecosystem From Repository Files
 
 For workflows that build, test, or install packages, add the matching ecosystem alongside `defaults`:

From c3bec36d02b732af41b56f2875286d908770270e Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 25 Sep 2026 09:01:19 +0000
Subject: [PATCH 2/2] Correct hosted-web accuracy details in network.md

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>
---
 .github/aw/network.md | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/aw/network.md b/.github/aw/network.md
index cd0c51f3cdd..ce00120c267 100644
--- a/.github/aw/network.md
+++ b/.github/aw/network.md
@@ -157,10 +157,10 @@ network:
 
 - `allowed` and `blocked` are mutually exclusive; each is a non-empty list of lowercase DNS hostnames (no wildcards).
 - `max-uses` optionally caps the number of hosted web tool invocations.
-- `hosted-web: false` rejects all hosted web tool calls for that workflow.
-- **Deny-by-default**: if `network` restricts domains for Claude or Codex without an explicit `hosted-web` policy, hosted web tools compile to disabled for that engine.
-- Ignored for engines other than Claude and Codex.
-- On import merge, allow/blocked lists from imported files combine with the main workflow's; a top-level scalar (`max-uses` or `hosted-web: false`) in either file takes precedence — see [syntax-tools-imports.md](syntax-tools-imports.md).
+- `hosted-web: false` disables hosted web tools for that workflow.
+- **Deny-by-default**: if a Claude or Codex workflow sets `network` explicitly without a `hosted-web` policy, hosted web tools compile to disabled for that engine.
+- Setting `hosted-web` on any engine other than Claude or Codex is a compile error.
+- On import merge, allowed/blocked lists from imported files combine with the main workflow's, but only when both policies are enabled; the main workflow's scalar settings (such as `max-uses`) and an explicit `hosted-web: false` on either side win — see [syntax-tools-imports.md](syntax-tools-imports.md).
 
 ## Inferring Ecosystem From Repository Files